T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Skill Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 52 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Classification**: T08: Insecure Dependencies ### Vulnerable Code Snippets Line 8: ```shell npx skills add Kokxi/qa-test-skills ``` Line 52: ```shell npx skills add Kokxi/qa-test-skills ``` ### Technical Analysis The Skill recommends executing an npm-resolved CLI through `npx` to retrieve and install content from the third-party `Kokxi/qa-test-skills` repository. Neither the CLI package version nor the repository revision is pinned to an immutable, previously reviewed release or commit. No checksum, signature, lockfile, or equivalent integrity validation is specified. Consequently, the content executed or installed when this command is used can differ from the content available when the Skill was audited. A compromise of the resolved npm package, its dependency chain, the remote repository, or the associated maintainer account could introduce attacker-controlled instructions or executable components. The command is presented as an optional recommendation rather than being automatically executed by the audited Skill. Therefore, this finding establishes a supply-chain exposure but does not establish that the referenced package or repository is currently malicious. ### Attack Path 1. A user or agent loads the Skill and follows its recommendation to install the complete Skill collection. 2. `npx` resolves and executes the unpinned `skills` package available at that time. 3. The CLI retrieves mutable content identified as `Kokxi/qa-test-skills`. 4. An attacker who has compromised the npm package, a transitive dependency, the remote repository, or a maintainer account supplies modified content. 5. The malicious installer or installed Skill content executes with the permissions granted to the invoking user or influences later agent sessions through a ...[truncated 823 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `npx` CLI to an explicitly reviewed version instead of allowing dynamic resolution. 2. Pin the remote Skill collection to an immutable commit hash or signed release tag. 3. Publish and verify cryptographic checksums or signatures before installation. 4. Use a lockfile and a trusted internal registry or vetted mirror where practical. 5. Document the exact package source, repository revision, expected files, and required permissions. 6. Review downloaded Skill instructions and scripts before enabling them or granting tool access. 7. Run installation in a sandbox with minimal filesystem, network, credential, and execution privileges. 8. Clearly state that installation is optional and require explicit user confirmation before executing the command.