T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned Third-Party Package Execution and Unreviewed Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```markdown If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. ``` ### Technical Analysis The skill instructs the agent to invoke the `skills` npm package through `npx` without pinning a reviewed package version or enforcing an integrity constraint. Depending on the local npm configuration and cache state, `npx` may retrieve and execute the current package release from an external registry at runtime. Consequently, the code ultimately executed can differ from the version that existed when this skill was audited. The workflow also permits skills to be installed from “GitHub or other sources.” No source allowlist, commit pin, signature verification, checksum validation, or mandatory content review is specified. The recommended installation command uses `-g`, which installs the selected skill at the user level, and `-y`, which suppresses the CLI confirmation prompt. This combination weakens supply-chain controls and removes a user-review checkpoint immediately before installation. This finding does not establish that the named CLI or any recommended skill is currently malicious. The vulnerability is the unsafe de ...[truncated 2075 chars]- Remediation
View remediation
find ``` - Record and review version changes before updating the pin. 2. **Enforce package integrity** - Use a lockfile and registry integrity metadata where supported. - Verify release signatures or published checksums before execution. - Prefer an internally mirrored or approved registry over unrestricted public resolution. 3. **Restrict installation sources** - Define an explicit allowlist of trusted owners, repositories, and registries. - Require immutable commit hashes or signed release tags rather than mutable branches or unspecified versions. - Do not permit installation from arbitrary “other sources.” 4. **Require pre-installation review** - Download the candidate skill into an isolated temporary directory without activating it. - Review its instruction files, scripts, dependencies, lifecycle hooks, and requested permissions. - Scan for remote payload retrieval, credential access, persistence, command execution, and instruction hijacking. 5. **Remove automatic confirmation bypass** - Do not use `-y` for security-sensitive installation operations. - Display the exact package source, pinned revision, requested scope, and review result before obtaining explicit user approval. 6. **Avoid global installation by default** - Install skills at project scope or in a disposable sandbox unless global availability is explicitly required. - Require separate informed consent before using `-g`. 7. **Apply runtime isolation** - Execute discovery and installation with minimal filesystem, network, credential, and tool access. - Prevent package lifecycle scripts where practical and test newly acquired skills in a sandbox before activation. ]]>