T08 · Insecure Dependencies
- Location
SKILL.md:62- Finding
Unpinned npm Package Execution and Global Third-Party Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:62andSKILL.md:128
Vulnerability Type: Supply-chain exposure through unpinned remote dependencies
Risk Level: MediumVulnerable Code
At
SKILL.md:62:bash npx -y skills@latest find <keywords> -y 2>&1At
SKILL.md:128:bash npx -y skills@latest add "{owner/repo@skill}" -g -yTechnical Analysis
The documented workflow executes
skills@latestthroughnpx. Thelatesttag is mutable, so the code executed during a future invocation may differ from the version reviewed during this audit. The-yoption suppresses the normal installation confirmation.The installation workflow also accepts a dynamically selected external skill identifier and installs it globally. The documented validation process considers popularity, repository reputation, stars, update activity, and external-service requirements, but it does not require:
- An exact package version or immutable repository commit.
- Package integrity hashes or signature verification.
- Inspection of scripts and lifecycle hooks before execution.
- Installation into a sandbox or restricted environment.
- Security review of every file in the selected skill.
Consequently, compromise of the npm package, its publishing account, an upstream repository, or a selected search result could cause attacker-controlled code or instructions to be executed or installed.
Attack Path
- An attacker compromises the npm package or publishing account associated with
skills, or compromises an upstream repository returned by the search workflow. - The attacker publishes a malicious release under the mutable
latesttag or modifies a selectable skill. - A normal skill search causes
npx -y skills@latestto download and execute the malicious release without an interactive package-installation prompt. - Alternatively, the malicious upstream skill is selected based on metadata such as stars, installation count, or ap ...[truncated 1059 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace
skills@latestwith an exact, reviewed version:bash npx -y skills@X.Y.Z find <keywords> -y - Pin the dependency with a lockfile and integrity metadata where the execution environment supports them.
- Resolve candidate skills to an immutable repository commit rather than installing from a mutable branch or tag.
- Verify package provenance, signatures, checksums, ownership history, and repository identity before execution.
- Download candidate skills into a temporary isolated directory and inspect all files, including lifecycle scripts, executables, nested dependencies, and agent instructions.
- Run package discovery and installation in a sandbox with restricted filesystem access, minimal environment variables, no unnecessary credentials, and constrained network access.
- Remove unattended confirmation flags from security-sensitive installation operations and show the user the exact package, version, repository, commit, destination, and requested permissions before proceeding.
- Prefer project-local installation over global installation. If global installation is necessary, require a separate explicit confirmation that explains its cross-project and cross-session scope.
- Add an allowlist for trusted package owners and repositories, while still requiring immutable version pinning and content review.
- Perform a post-installation integrity check and provide a documented removal procedure.
- Replace