T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party Package Execution During Global Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Supply-chain risk from an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add nexscope-ai/eCommerce-Skills --skill product-differentiation-ebay -g ``` ### Technical Analysis The documented installation command uses `npx` to resolve and execute the `skills` npm package without specifying a reviewed version or integrity hash. It also obtains Skill content from a third-party repository without pinning that source to an immutable commit. Because both components are mutable, the code and content executed during installation may differ from what existed when this project was audited. A compromised npm package, registry account, repository, release, or upstream maintainer account could therefore introduce malicious installation behavior. The `-g` option increases the scope by installing the Skill globally rather than restricting it to the current project. No lockfile, checksum, package signature, commit hash, or other reproducible verification mechanism is provided. ### Attack Path 1. An attacker compromises or gains control of the npm package resolved as `skills`, its publisher account, its distribution channel, or the referenced Skill repository. 2. The attacker publishes a modified package or replaces mutable repository content with a malicious version. 3. A user follows the installation instructions and runs the documented `npx` command. 4. `npx` downloads and executes the attacker-controlled package version, which then processes attacker-controlled repository content. 5. Malicious code runs with the privileges of the installing user, or malicious Skill instructions are installed into the user's global Skill environment. ### Impact Assessment Successful exploitation could execute arbitrary commands with the installing user's privileges. Depending on those privileges and the behavior of the compromised installer, th ...[truncated 390 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` CLI to an explicitly reviewed version: ```bash npx skills@<reviewed-version> add ... ``` 2. Pin the Skill repository to an immutable, reviewed commit or signed release rather than a mutable branch. 3. Verify downloaded artifacts using published cryptographic checksums or signatures before execution. 4. Commit an appropriate lockfile where supported and use a trusted, explicitly configured package registry. 5. Prefer a project-local installation instead of `-g` unless global installation is strictly necessary. 6. Publish the exact expected package version, repository commit, checksum, and verification procedure in `SKILL.md`. 7. Run installation with a non-privileged account in an isolated environment and review package lifecycle scripts before execution. ]]>