T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Unpinned Third-Party Package and Remote Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 26-31, 95-99, and 305-313 **Vulnerability Type**: Supply-chain risk caused by mutable dependencies and unverified remote skill artifacts **Risk Level**: Medium ### Vulnerable Code `SKILL.md`, lines 26-31: ```bash npm install -g reskill ``` If a global installation is not available, `npx reskill@latest` can be used as a fallback. The agent should check for a global install before falling back to npx. `SKILL.md`, lines 95-99: ```bash which reskill ``` `SKILL.md`, lines 305-313: ```bash # Install to specific agent(s) reskill install <name> -y -a <agents...> --registry https://rush.zhenguanyu.com # Install globally (user-level, available in all projects) reskill install <name> -y -g --registry https://rush.zhenguanyu.com ``` ### Technical Analysis The Skill instructs the agent to install or execute `reskill` without pinning it to a reviewed, immutable version. The fallback explicitly uses the mutable `reskill@latest` tag, while `npm install -g reskill` also resolves the current package version at installation time. As a result, the package ultimately executed may differ from the version reviewed when this Skill was published. The Skill additionally installs remote artifacts from a community registry without requiring artifact hashes, signature verification, immutable version identifiers, or a local security review. The `-y` option suppresses the package manager's interactive confirmation, making conversational user approval the primary approval boundary. This creates a supply-chain exposure in which compromise of the npm package, its publisher account, the configured registry, a registry publisher account, or a selected skill artifact could cause attacker-controlled content to be installed. The project itself contains no embedded malicious script; the risk originates from mutable and externally controlled dependencies. ### A ...[truncated 1563 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `reskill` to an exact, reviewed version instead of using `@latest` or an unspecified version: ```bash npx reskill@<reviewed-version> npm install -g reskill@<reviewed-version> ``` 2. Verify the npm package through an approved lockfile, package integrity digest, provenance attestation, or trusted internal package mirror. 3. Require immutable skill versions and verify signed registry metadata or cryptographic artifact hashes before installation. 4. Display the exact resolved package version, skill version, publisher, source registry, digest, requested installation targets, and security-review status before requesting approval. 5. Bind user approval to the exact artifact and digest so the approved content cannot change between presentation and installation. 6. Avoid `-y` unless explicit prior approval has been obtained for the exact immutable artifact and destination. 7. Prefer project-local, least-privilege installation over global installation. Do not run npm, npx, or `reskill` with elevated privileges. 8. Consider using an allowlisted internal registry containing reviewed and mirrored skill artifacts.