T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Installation Command Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 54 **Vulnerability Type**: Unpinned third-party package and Skill installation **Risk Level**: Medium ### Vulnerable Code Line 8: ```text 本技能属于 QA Test Skills 技能集（49 个技能之一），完整工作流体验需安装全套：npx skills add Kokxi/qa-test-skills ``` Line 54: ```text > ⚠️ 本技能单独使用效果有限，建议配合完整技能集（12 步工作流）使用。安装：npx skills add Kokxi/qa-test-skills ``` ### Technical Analysis The documentation recommends running `npx skills add Kokxi/qa-test-skills`. This command relies on two mutable, third-party supply-chain components: 1. `npx` may retrieve and execute the `skills` package without a pinned package version. 2. The referenced `Kokxi/qa-test-skills` source is not pinned to an immutable release or commit. Consequently, the content executed or installed when a user follows the recommendation may differ from the content available when this artifact was audited. The external package and repository are not included in the reviewed project, so their behavior cannot be verified by this audit. No evidence establishes that either dependency is currently malicious. The issue is the unsafe, unpinned trust relationship and the resulting opportunity for package compromise, account takeover, or upstream content replacement. ### Attack Path 1. An attacker compromises the package resolved by `npx`, the referenced repository, or an associated publishing account. 2. The attacker publishes a malicious package version or modifies the repository content. 3. A user follows the installation recommendation in `SKILL.md`. 4. `npx` retrieves the currently resolved package, which then obtains or installs mutable third-party content. 5. Malicious package code may execute with the invoking user's privileges, or hostile Skill instructions may be installed and subsequently loaded by an agent. ### Impact Assessment If the upstream package execution path is compromised, attacker code could act ...[truncated 532 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` runner to an explicitly reviewed version rather than allowing `npx` to resolve the latest release. 2. Pin `Kokxi/qa-test-skills` to a verified immutable commit hash or signed release. 3. Publish and verify cryptographic checksums or signatures for downloaded artifacts. 4. Review the runner and the complete external Skill collection before recommending installation. 5. Use a lockfile or equivalent integrity-controlled dependency manifest where supported. 6. Run installation in a sandbox with minimal filesystem, credential, and network access. 7. Reword the documentation so external installation is clearly optional and warn users that it introduces code and instructions outside this artifact's audited scope.