T08 · Insecure Dependencies
Error
- Location
- SKILL.md:23
- Finding
- Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-31 **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: High ### Vulnerable Code ```markdown **CLI execution approach:** To avoid downloading remote code on every invocation, we recommend installing reskill globally first: ```bash npm install -g reskill ``` If a global installation is not available, `npx reskill@latest` can be used as a fallback. The agent should check for a global install (`which reskill`) before falling back to npx. ``` ### Technical Analysis The instructions direct agents to install or execute the third-party `reskill` npm package without pinning it to a reviewed version or verifying an integrity digest. `npm install -g reskill` resolves a mutable package version and installs it globally. Depending on the package contents and npm configuration, installation can also execute lifecycle scripts. The global installation persists an executable in the user's environment. The fallback, `npx reskill@latest`, is especially sensitive because it downloads and executes whichever package release carries the `latest` tag at invocation time. Consequently, the effective executable code can change after this Skill has been reviewed. Checking for an existing executable with `which reskill` confirms only its presence, not its origin, version, or integrity. This creates a third-party supply-chain trust boundary. Package-account compromise, malicious publication, dependency confusion within the package's dependency graph, or registry compromise could convert the documented workflow into arbitrary code execution. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry response, or a transitive dependency used by `reskill`. 2. The attacker publishes a malicious release or causes the mutable `latest` resolution to select attacker-controlled content. 3. An agent follows the Skill and runs `npm ...[truncated 1033 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `reskill` to a specific, reviewed version rather than an unbounded package name or the `latest` tag. 2. Verify the package tarball against a trusted integrity digest before execution. 3. Prefer a project-local installation with a reviewed lockfile over a global installation. 4. Avoid `npx ...@latest`; if `npx` is necessary, use an exact version and disable interactive package substitution. 5. Disable npm lifecycle scripts during installation where the package's documented functionality permits it, and separately review any required scripts. 6. Verify an existing `reskill` executable by resolving its path, version, package origin, and integrity rather than relying only on `which reskill`. 7. Require explicit user approval before downloading or executing third-party package-manager code. 8. Run the CLI in a restricted environment with only the filesystem and network permissions required for the requested operation. 9. Document the exact trusted registry and consider enforcing npm provenance or signed-release verification. ]]>