T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Skill Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 38 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Complete vulnerable snippet:** ```text npx skills add Kokxi/qa-test-skills ``` The command appears in the Skill description and again in the installation recommendation. ### Technical Analysis The documentation recommends using `npx` to execute a package-resolved CLI and install Skill content from the external `Kokxi/qa-test-skills` repository. Neither the CLI package version nor the external repository commit is pinned, and no integrity hash or signature is specified. Consequently, the command may retrieve content that differs from what was available when this Skill was reviewed. The external CLI and repository are not included in the audited project, so their behavior cannot be verified from the available artifact. If either distribution channel is compromised, later users could install modified instructions, scripts, or other components. ### Attack Path 1. An attacker compromises the package resolved by `npx`, the referenced repository, or an associated maintainer account. 2. The attacker publishes a malicious CLI release or modifies the externally hosted Skill collection. 3. A user follows the recommendation and runs: ```text npx skills add Kokxi/qa-test-skills ``` 4. `npx` resolves and executes the mutable third-party CLI, which retrieves mutable external content. 5. The compromised content is installed into the user's Skill environment. 6. When the installed Skills are loaded or invoked, any malicious instructions or executable components they contain may operate with the permissions granted to the relevant agent or installation process. This attack path depends on the user manually executing the recommended command and on compromise or malicious modification of an external dependency. ### Impact Assessment The immediate audited ...[truncated 770 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` CLI to a specifically reviewed version rather than allowing `npx` to resolve the latest release: ```text npx skills@<audited-version> add ... ``` 2. Pin the external Skill collection to an immutable, reviewed commit instead of a mutable repository reference. 3. Verify downloaded artifacts using a cryptographic digest or trusted signature before installation. 4. Use a lockfile or equivalent reproducible dependency manifest where supported. 5. Prefer bundling reviewed dependencies with the project when licensing and distribution requirements permit. 6. Document the external trust boundary and advise users to inspect the resolved package and downloaded Skill content before execution. 7. Run installation with least privilege in a sandboxed environment, without credentials or access to sensitive workspaces. 8. Re-audit the complete downloaded Skill set and its scripts before granting it command execution, network access, or write permissions.