T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned CLI Execution and Mutable Remote Skill Installation## Vulnerability Details **File Location**: `SKILL.md:4`, `SKILL.md:15-24`, `SKILL.md:47-99`, and `SKILL.md:106-113` **Vulnerability Type**: Unpinned third-party CLI and unverified remote Skill installation **Risk Level**: Medium The Skill grants broad permission to execute every command and argument supported by the `skills` CLI: ```yaml allowed-tools: Bash(npx skills *) ``` It then recommends invoking an unpinned npm CLI and installing mutable remote Skills: ```bash # Search for skills npx skills search "inference-sh image generation" # List available skills npx skills list inference-sh/skills # Install a skill npx skills add inference-sh/skills@ai-image-generation ``` The same pattern is used for additional installations and bulk installation: ```bash npx skills add inference-sh/skills@ai-image-generation npx skills add inference-sh/skills@ai-video-generation npx skills add inference-sh/skills@ai-music-generation npx skills add inference-sh/skills@inference-sh ``` The management instructions also permit updating installed Skills to unspecified future versions: ```bash # List installed skills npx skills list # Update all skills npx skills update # Remove a skill npx skills remove inference-sh/skills@ai-image-generation ``` ### Technical Analysis The command `npx skills` does not identify an exact reviewed npm package version or integrity digest. Depending on the local environment and npm behavior, `npx` can retrieve and execute the currently published package when it is not already available locally. Consequently, the code executed at audit time may differ from the code executed later. The `skills add` and `skills update` operations likewise obtain mutable third-party Skill content without an immutable commit, release digest, signature requirement, or documented review gate. The wildcard declaration `Bash(npx skills *)` authorizes all subcommands and arguments accepted by the ...[truncated 1862 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to an exact reviewed version, for example by invoking an explicitly versioned package rather than `npx skills`. 2. Lock and verify the package with a trusted integrity digest and an approved registry configuration. 3. Pin every installed Skill to an immutable commit, signed release, or content digest rather than a mutable name or branch. 4. Download and inspect Skill manifests, scripts, lifecycle hooks, and permission declarations before installation. 5. Require explicit human approval before any `add` or `update` operation. 6. Replace `Bash(npx skills *)` with narrowly scoped permissions for specifically approved commands and arguments. Separate read-only discovery from installation and update capabilities. 7. Run installation in a sandbox using a minimally privileged account with restricted filesystem, credential, process, and network access. 8. Avoid unrestricted bulk updates. Review release differences and integrity metadata before applying each update. 9. Maintain an allowlist of approved Skill identifiers, versions, publishers, and cryptographic hashes.