T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned Third-Party CLI Execution and Unattended Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```markdown ### Step 4: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` ``` ### Technical Analysis The skill instructs the agent to execute `npx skills` without pinning the npm package to a reviewed version or verifying its integrity. Depending on the local npm and `npx` configuration, this can download and execute the package currently resolved by the configured registry. Its effective code may therefore differ from the version that was previously reviewed. The CLI is then used to install skills from GitHub or other sources. The documented installation command combines global installation (`-g`) with unattended confirmation (`-y`). The workflow does not require validation of the source owner, review of downloaded files, immutable commit pinning, checksum verification, package provenance verification, or final informed approval before installation. This creates a supply-chain trust boundary in which compromised, replaced, typosquatted, or otherwise malicious CLI packages and skills could execute under the privileges of the agent process. ### Attack Path 1. An attacker compromises, replaces, or impersonates the npm package resolved as `skills`, or publishes a malicious skill through a source accepted by the CLI. 2. The ...[truncated 1424 chars]- Remediation
View remediation
find ``` 2. Configure npm to use a trusted registry and verify package provenance, signatures, and integrity metadata before execution. 3. Prefer installing the CLI as a locked project dependency rather than downloading and executing the currently published package through an unpinned `npx` command. 4. Restrict skill sources to an explicit allowlist of reviewed owners and repositories. 5. Pin skill installations to immutable commit hashes or verified release tags rather than mutable branches or unversioned identifiers. 6. Download and inspect skill contents before activation, including instructions, scripts, package manifests, lifecycle hooks, and external network operations. 7. Remove `-y` and require explicit, informed user confirmation after presenting the exact source, revision, requested installation scope, and review results. 8. Prefer project-local or sandboxed installation instead of `-g` to limit the affected scope. 9. Run installation in a least-privileged environment without unnecessary credentials or access to sensitive files. 10. Do not perform bulk updates without reviewing release changes and revalidating the integrity and provenance of every updated component. ]]>