T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Skill Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 49 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Line 8: ```shell npx skills add Kokxi/qa-test-skills ``` Line 49: ```shell npx skills add Kokxi/qa-test-skills ``` ### Technical Analysis The skill twice recommends using `npx` to install a third-party skill collection without specifying an immutable installer version, repository commit, checksum, or signature. Both the package resolved by `npx` and the referenced skill collection may therefore change after this skill has been reviewed. If either upstream distribution channel is compromised or publishes a malicious update, users following the documented command could retrieve and process content different from the version originally assessed. The project provides no integrity-verification procedure or evidence that the retrieved package and skill files have been independently reviewed. The command is presented as a recommendation rather than being automatically executed by the audited skill. Exploitation therefore requires a user or agent to follow the installation instruction. ### Attack Path 1. An attacker compromises the package resolved by `npx`, the referenced repository, or an associated publishing account. 2. The attacker publishes a modified installer or skill collection under the same mutable package or repository identifier. 3. A user or agent follows the command documented in `SKILL.md`. 4. `npx` resolves the currently available installer, which may differ from the reviewed version. 5. The installer retrieves or installs the attacker-controlled skill content. 6. Malicious instructions, configuration, or executable lifecycle behavior may then run with the privileges of the invoking user or influence later agent sessions. ### Impact Assessment Successful exploitation could modify the user's installed Agent ski ...[truncated 482 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `npx` installer to a specific reviewed version rather than relying on the latest registry resolution. 2. Pin the external skill collection to an immutable release or full commit hash. 3. Publish expected cryptographic checksums or signatures and require verification before installation. 4. Use a trusted package registry and enable provenance or signature verification where supported. 5. Review the downloaded package, lifecycle scripts, and skill files before allowing installation. 6. Run installation in a sandbox or least-privileged environment without access to credentials or sensitive project files. 7. Document the exact versions that were security-reviewed and establish a controlled process for reviewing upgrades.