T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 8; repeated at line 56 **Vulnerability Type**: Unpinned and unverified third-party dependency installation **Risk Level**: Medium **Vulnerable code at line 8:** ```yaml description: >- 当项目还在需求阶段或者开发正在写代码时使用此技能——这时候介入能花最小的成本避免最多的缺陷。从需求可测试性评审（需求模糊/矛盾/不可测）、开发阶段测试设计（单元测试/接口契约/测试桩）和技术方案评审（影响面分析/风险识别）三个维度提前发现缺陷。越早发现 Bug 修复成本越低——需求阶段的 Bug 修复成本是线上阶段的 1/100。输出左移检查清单和阶段性介入记录。 本技能属于 QA Test Skills 技能集（49 个技能之一），完整工作流体验需安装全套：npx skills add Kokxi/qa-test-skills ``` **Repeated installation instruction at line 56:** ```markdown > ⚠️ 本技能单独使用效果有限，建议配合完整技能集（12 步工作流）使用。安装：npx skills add Kokxi/qa-test-skills ``` ### Technical Analysis The Skill recommends running `npx skills add Kokxi/qa-test-skills`, but it does not pin the referenced repository to an immutable commit, audited release, or verified integrity digest. Consequently, the content installed by this command may differ from the content that existed when this Skill was audited. The command crosses two mutable trust boundaries: `npx` may dynamically resolve and execute package tooling, and that tooling then retrieves a third-party skill collection identified only by its repository name. If either dependency source is compromised or later changed maliciously, the installation can introduce unaudited code or agent instructions. The command is documentation rather than an automatically executed payload, and the reviewed project does not establish that the current upstream dependency is malicious. The vulnerability is therefore a conditional supply-chain exposure requiring a user or agent to execute the recommended command. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or a package involved in resolving the `npx skills` command. 2. The attacker adds malicious scripts, unsafe lifecycle behavior, or hostile agent instructions to the mutable upstream content. 3. A user or a ...[truncated 1277 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the third-party installation recommendation if the external collection is not necessary for the Skill's core operation. 2. If installation is retained, pin the source to an immutable, reviewed commit hash or cryptographically signed release rather than a mutable repository reference. 3. Verify downloaded content using a trusted checksum or signature before installation. 4. Pin the `npx` package and version used to perform installation, and use a trusted registry with lockfile and integrity verification where supported. 5. Require explicit user confirmation before retrieving or installing external content; the Skill must not run the command automatically. 6. Document all files, scripts, lifecycle hooks, permissions, and network operations introduced by the dependency. 7. Review the pinned upstream content independently and repeat the security audit before changing the pinned revision. 8. Perform installation in a restricted environment using least privilege, limited filesystem access, no unnecessary secrets, and constrained network access.