T08 · Insecure Dependencies
Error
- Location
- SKILL.md:24
- Finding
- Unpinned Third-Party CLI Execution and Unreviewed Global Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24–29, 49–50, and 75–80 **Vulnerability Type**: Supply-chain risk through unpinned dependencies and unsafe installation instructions **Risk Level**: High ### Vulnerable Code Lines 24–29: ```markdown **Key commands:** - `npx skills find [query]` - Search for skills interactively or by keyword - `npx skills add <package>` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` Lines 49–50: ```bash npx skills find [query] ``` Lines 75–80: ```markdown ### Step 4: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add <owner/repo@skill> -g -y ``` ``` ### Technical Analysis The skill instructs the agent to execute `npx skills` without pinning the npm package to an exact, reviewed version or requiring integrity verification. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the currently resolved package release from an external registry. Consequently, the code executed can change after this skill has been reviewed. The subsequent installation workflow accepts packages discovered through an external search service without requiring validation of repository ownership, immutable commit identifiers, package contents, installation hooks, or cryptographic integrity. The recommended `-g` option installs the selected skill globally at the user level, while `-y` suppresses confirmation prompts. Together, these options increase the scope and persistence of a compromised installation while removing an opportunity for manual review. This is a supply-chain weakness rather than evidence that the currently referenced CLI or any specific skill is malicious. Exploitation depends on compromise, replacement, dependency confusion, typosquatting, or malicious content in a selected third-party source. ### Attack Path 1. A ...[truncated 1707 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin the CLI to an audited version** - Use an exact version, such as `npx --yes skills@<reviewed-exact-version>`. - Do not use version ranges or floating tags such as `latest`. - Record and periodically review the approved version. 2. **Verify package identity and integrity** - Confirm the official npm package name, publisher, registry, and repository. - Use lockfiles and registry integrity metadata where the environment supports them. - Validate signatures, checksums, or provenance attestations before execution. 3. **Avoid implicit remote execution** - Prefer installing the approved CLI as a project-local, locked development dependency. - Execute it from the locked local dependency rather than allowing `npx` to fetch an arbitrary current release. - Run discovery operations in a restricted sandbox with minimal filesystem and credential access. 4. **Require skill-source review** - Verify repository ownership and reputation. - Inspect all skill files, scripts, package manifests, lifecycle hooks, and transitive dependencies. - Pin installations to an immutable commit hash or signed release rather than a mutable branch or tag. 5. **Remove unsafe installation defaults** - Do not recommend `-g` by default; prefer project-local or isolated installation. - Do not use `-y` for security-sensitive installation operations. - Display the exact source and resolved revision and obtain explicit user approval before installation. 6. **Apply least privilege** - Perform searches and installations without administrator privileges. - Prevent installation processes from accessing unrelated credentials, private keys, or sensitive workspaces. - Test newly obtained skills in a disposable environment before making them available to normal agent sessions. 7. **Separate discovery from installation** - Searching for a skill must not automatically authorize its installation. - Add a mandat ...[truncated 113 chars]