T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 9 **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown > **Requires `caremax-auth` as a sibling directory** (`../caremax-auth/`, same layout as `skills/caremax-auth` + `skills/caremax-indicators` in this repo, or under `~/.agents/skills/`). If missing: `npx skills add KittenYang/caremax-skills` and select caremax-auth. ``` ### Technical Analysis The installation instruction invokes the `skills` npm command through `npx` without pinning the package to a reviewed version. It also identifies the `KittenYang/caremax-skills` repository without pinning it to a specific commit hash or immutable signed release. Both components can therefore resolve to content that differs from what was available during this audit. The installed `caremax-auth` dependency is subsequently trusted to provide shell scripts used for authentication and API access, including `api-call.sh`, `auth-flow.sh`, `list-system-presets.sh`, and `quick-log.sh`. Those scripts are not included in the audited project, so their integrity and behavior cannot be verified here. This is a supply-chain weakness rather than evidence that the current upstream dependency is malicious. Exploitation would require compromise or malicious modification of the npm package, its publishing account, the referenced repository, or another mutable dependency in the installation path. ### Attack Path 1. The required sibling `caremax-auth` directory is absent. 2. An agent or operator follows the documented recovery instruction and executes: ```bash npx skills add KittenYang/caremax-skills ``` 3. `npx` resolves an unpinned version of the `skills` package, and the installer retrieves content from a repository reference that is not bound to an audited commit. 4. If either source has been compromised or maliciously modified, attacker-controlled skill files or script ...[truncated 1233 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI dependency to a reviewed exact version rather than allowing `npx` to resolve the latest release: ```bash npx skills@<audited-exact-version> add ... ``` 2. Pin the skill repository to a verified immutable commit hash or a signed release instead of relying on a mutable repository branch or default reference. 3. Publish and verify cryptographic checksums or signatures for the installed `caremax-auth` files before executing any script. 4. Vendor the minimum required, reviewed authentication scripts with the project where licensing and maintenance requirements permit it. 5. Add a verification step that rejects unexpected files or hash changes in `../caremax-auth/scripts/`. 6. Run authentication and API scripts with least privilege, restricting filesystem access, environment variables, credential exposure, and network destinations where practical. 7. Document the exact audited dependency versions and establish a controlled process for reviewing and updating them. ]]>