T08 · Insecure Dependencies
Error
- Location
SKILL.md:23- Finding
Unpinned Third-Party CLI Download and Execution via npx
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ### Technical Analysis The skill instructs the agent to invoke the `skills` npm package through `npx` without specifying an exact package version or integrity value. If the package is not already available in the local npm cache, `npx` can retrieve and execute it from the configured npm registry. Because the effective CLI implementation is external and unpinned, it can change after this skill has been reviewed. The skill does not require verification of the package publisher, resolved version, cryptographic integrity, or package contents before execution. It also does not require lifecycle scripts to be disabled. This creates a supply-chain execution risk if the upstream package or publisher is compromised, the registry configuration is redirected, or dependency resolution returns a malicious package version. ### Attack Path 1. An attacker compromises the upstream `skills` package, its publisher account, or a registry used by the environment. 2. The attacker publishes or serves a malicious version under the package name resolved by `npx skills`. 3. A user request activates this skill and causes the agent to execute `npx skills find`, `add`, `check`, or `update`. 4. `npx` downloads the unresolved or latest available package version. 5. Malicious package lifecycle logic or CLI code executes with the operating ...[truncated 612 chars]- Remediation
View remediation
find ``` 2. Verify the resolved package name, publisher, version, and registry before execution. 3. Use npm lockfiles and integrity hashes where the deployment model supports them. 4. Prefer a preinstalled, administrator-reviewed CLI over downloading executable code during skill invocation. 5. Disable package lifecycle scripts where feasible, such as by using an installation workflow with `--ignore-scripts`. 6. Require explicit user approval before downloading or executing the CLI for the first time. 7. Execute the CLI in a sandbox with restricted filesystem, credential, and network access. 8. Periodically review pinned versions before upgrading rather than automatically accepting the latest release. ]]>