T08 · Insecure Dependencies
Warning
- Location
SKILL.md:31- Finding
Unpinned Third-Party CLI Execution and Unverified Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```bash npx skills find [query] ``` ```markdown Install with npx skills add vercel-labs/agent-skills@vercel-react-best-practices └ https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices ``` ```bash npx skills add -g -y ``` ### Technical Analysis The skill instructs the Agent to invoke `npx skills` without pinning the npm package to a reviewed version or verifying its package integrity. An unpinned `npx` invocation may dynamically resolve and execute package content obtained from the npm registry. The workflow also permits skills to be installed from GitHub or other external sources. It does not require verification of the repository owner, immutable commit, release signature, package checksum, source code, or installation scripts. Search results are consequently treated as potential installation candidates without an established trust boundary. The suggested installation command uses both `-g` and `-y`. The `-g` option creates a user-level global installation that can affect subsequent Agent sessions, while `-y` suppresses confirmation prompts. This combination increases supply-chain risk by allowing an unreviewed third-party component to be installed persistently without an immediate interactive security decision. This finding does not establish that the referenced CLI or example skill is malicious. The vulnerability is the unsafe dependency acquisition and installation process, which exposes the Agent environment to registry c ...[truncated 1887 chars]- Remediation
View remediation
find ``` 2. Verify the pinned npm package through an approved lockfile, registry policy, package signature, or integrity hash. Re-review it before changing the pinned version. 3. Restrict installation sources to an explicit allowlist of reviewed publishers and repositories. 4. Pin GitHub-hosted skills to immutable commit hashes or cryptographically verified releases rather than mutable branches or tags. 5. Require source review before installation, including inspection of package manifests, lifecycle scripts, executable files, tool permissions, and skill instructions. 6. Remove `-y` from the default workflow and require explicit user confirmation immediately before installation. The confirmation should display the exact source, version or commit, requested scope, and relevant security warning. 7. Avoid global installation by default. Install each skill in an isolated project directory, sandbox, container, or other least-privileged environment. 8. Disable package lifecycle scripts during initial inspection where supported, and only enable them after review. 9. Clearly state that search results and third-party skills are untrusted external content and must not be installed solely because they appear in search results. 10. Document an uninstall and incident-response procedure for removing globally installed skills, reviewing affected configuration, and rotating credentials potentially exposed to a malicious installation. ]]>