T08 · Insecure Dependencies
Warning
- Location
- README.md:23
- Finding
- Unpinned Third-Party CLI and Mutable Repository Installation## Vulnerability Details **File Location**: `README.md:23-57` **Vulnerability Type**: Unpinned third-party dependency execution and mutable remote installation source **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add ./analytics-sdk-setup -a claude-code ``` ```bash npx skills add Peter-WF/analytics-sdk-setup -a claude-code ``` ```bash npx skills list -a claude-code ``` ```bash npx skills add ./analytics-sdk-setup -g -a claude-code ``` ### Technical Analysis The documented commands invoke the `skills` npm package through `npx` without specifying a reviewed version or enforcing an integrity constraint. If the package is absent locally, `npx` may retrieve and execute the currently resolved package version from the configured npm registry. The effective executable can therefore change after this project has been reviewed. The GitHub-source installation command also identifies the Skill through a repository name without pinning it to an immutable commit. Changes to the repository's default branch can consequently alter the installed content. This is especially significant for an agent Skill because installed instructions may later influence coding-agent behavior and access to project files. These commands are documentation examples and are not executed automatically by the project. Exploitation therefore requires a user or automation process to follow the installation instructions. The risk arises from trusting mutable third-party supply-chain components at execution and installation time. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the configured registry, or the referenced GitHub repository. 2. The attacker publishes a malicious package version or changes the repository's default-branch content. 3. A user follows the README and runs an unpinned `npx skills` command. 4. `npx` resolves and executes the attacker-controlled package version with the user's ...[truncated 999 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to a reviewed, exact version: ```bash npx --yes skills@X.Y.Z list -a claude-code ``` Replace `X.Y.Z` with a verified release and establish a controlled process for updating it. 2. Prefer installing the CLI through a lockfile-controlled development dependency and invoking the locally installed binary: ```bash npm install --save-dev --save-exact skills@X.Y.Z npx --no-install skills list -a claude-code ``` 3. Commit and review the package-manager lockfile. In automated environments, use reproducible installation commands such as `npm ci`. 4. Pin repository-based Skill sources to an immutable commit SHA rather than a mutable default branch, if supported by the CLI. Otherwise, download and review a fixed archive before installing it from a local path. 5. Verify package provenance, publisher identity, checksums, signatures, and registry configuration before execution. Document the expected package name and source to reduce dependency-confusion and registry-substitution risk. 6. Prefer project-scoped installation. Clearly warn that global installation broadens the impact to other projects and should only be performed after reviewing the exact installed content. 7. Run installation in a least-privileged environment without unnecessary credentials, sensitive environment variables, or write access beyond the intended project.