T08 · Insecure Dependencies
Warning
- Location
SKILL.md:276- Finding
Unpinned and Unattended Global Installation of Third-Party Skills
- Content
View full analysis
# Examples: npx skills find slack notification npx skills find browser automation npx skills find pdf extract npx skills find github api ``` ### Evaluate Search Results When results are returned: ``` Install with npx skills add owner/repo@skill-name └ https://skills.sh/owner/repo/skill-name ``` Evaluate each result for: - **Relevance**: Does it match the required capability? - **Completeness**: Does it cover all needed functionality? - **Quality**: Is it well-documented and maintained? ``` `SKILL.md:276-279`: ```yaml skills_to_install: - skill: "owner/repo@skill-name" command: "npx skills add owner/repo@skill-name -g -y" url: "https://skills.sh/owner/repo/skill-name" ``` `SKILL.md:443-460`: ```markdown 1. **Start with skill search**: Always check https://skills.sh/ before creating new skills 2. **Use specific search terms**: Combine capability keywords with domain terms 3. **Leverage built-in capabilities**: Don't create skills for things the agent can do natively 4. **Create reusable skills**: Design new skills to be general-purpose when possible 5. **Document thoroughly**: New skills should have clear usage instructions 6. **Verify before proceeding**: Confirm skill installation before executing tasks 7. **Handle errors gracefully**: Include fallback strategies in execution plans ## In ...[truncated 3724 chars]- Remediation
View remediation