T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 49 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippet The following installation command is recommended twice: ```shell npx skills add Kokxi/qa-test-skills ``` ### Technical Analysis The documentation directs users to invoke the `skills` package through `npx` and install the external `Kokxi/qa-test-skills` collection. Neither the CLI package nor the skill collection is pinned to a reviewed version, release, commit hash, checksum, or other immutable identifier. Consequently, the content installed when the command is executed may differ from the content that existed when this artifact was audited. The effective installation behavior depends on mutable third-party package registries and repositories outside the audit scope. This is a supply-chain weakness rather than evidence that the referenced dependency is currently malicious. Exploitation would require compromise of the relevant package, repository, maintainer account, publishing process, or dependency-resolution path. ### Attack Path 1. An attacker compromises the package registry entry, upstream repository, maintainer credentials, or another component in the dependency distribution chain. 2. The attacker publishes or introduces a malicious version of the CLI or skill collection. 3. A user follows the installation recommendation in `SKILL.md`. 4. `npx` resolves the unpinned package, and the installer retrieves the mutable external skill collection. 5. The malicious content is installed or processed under the invoking user's privileges. 6. Depending on the behavior of the retrieved package, it could introduce unreviewed agent instructions or execute code through installation hooks or subsequent skill use. ### Impact Assessment The maximum practical impact depends on the privileges of the user running the installation command and the behavior permitted by the pack ...[truncated 541 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` CLI to a specific reviewed version rather than allowing `npx` to resolve the current version: ```shell npx skills@<reviewed-version> add ... ``` 2. Pin the external skill collection to an immutable release tag or, preferably, a verified commit hash supported by the installer. 3. Publish expected checksums or signatures and verify them before installation. 4. Document the canonical package registry and repository URL so users can detect dependency confusion or repository impersonation. 5. Review the complete dependency and skill contents before recommending them as part of the workflow. 6. Use lockfiles or an equivalent reproducible dependency manifest where supported. 7. Run installation in a least-privilege, isolated environment without production credentials or sensitive workspace data. 8. Clarify that installation of the external collection is optional and outside the security guarantees of this audited skill.