T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 50 **Vulnerability Type**: Unpinned third-party dependency and mutable repository reference **Risk Level**: Medium ### Vulnerable Code The installation command appears twice: ```shell npx skills add Kokxi/qa-test-skills ``` ### Technical Analysis The documented command invokes the `skills` package through `npx` without specifying an exact, reviewed package version. It also identifies the external skill collection using the mutable repository reference `Kokxi/qa-test-skills`, rather than an immutable commit identifier with integrity verification. Consequently, the software retrieved when a user follows this recommendation may differ from the content that was available when this project was audited. Compromise of the package registry account, the referenced repository, its maintainers, or the dependency-resolution path could cause modified content to be downloaded. The command is documentation and is not executed automatically by the audited skill. Exploitation therefore requires a user or automation process to follow the installation recommendation. ### Attack Path 1. An attacker compromises or otherwise gains control over the unpinned `skills` package, the referenced repository, or an associated distribution account. 2. The attacker publishes a modified package or changes content resolved through the mutable repository reference. 3. A user follows the installation guidance and runs `npx skills add Kokxi/qa-test-skills`. 4. `npx` resolves and runs the available CLI package, which retrieves or installs the current external skill content. 5. Malicious package behavior, installation hooks, scripts, or skill instructions execute or become available in the user's environment. ### Impact Assessment If the resolved CLI package executes malicious code, it could operate with the privileges of the user running `npx`. Depending on the user's permissions and ...[truncated 528 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` CLI to an exact reviewed version, for example by using an explicit package version rather than the latest registry resolution. 2. Pin the external skill collection to a verified immutable commit or signed release rather than a mutable repository name or branch. 3. Publish and verify cryptographic hashes or signatures for all installed files. 4. Review downloaded skill files and scripts before loading or executing them. 5. Disable lifecycle scripts during package retrieval where supported, unless those scripts have been explicitly reviewed. 6. Run installation in a sandbox or least-privileged environment without production credentials or access to sensitive files. 7. Use an approved internal registry or vendored, reviewed copy of the dependency where possible. 8. Update both occurrences of the installation guidance so users are not directed to the unpinned command.