T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Package and Remote Skill Installation## Vulnerability Details **File Location**: `SKILL.md:35-38` **Vulnerability Type**: Unpinned third-party dependency and mutable remote skill source **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Connect once ``` npx skills add powmcp/skills --skill diagnose-rejected-invoice-before-resubmission ``` ``` ### Technical Analysis The documented installation command invokes `npx` without pinning the `skills` npm package to a specific version. It also identifies the remote `powmcp/skills` source without an immutable commit hash or equivalent integrity constraint. Consequently, the components retrieved when a user runs this command may differ from those reviewed during this audit. Compromise of the npm package, its maintainer account, the remote repository, or the dependency resolution process could cause attacker-controlled code or modified Skill content to be downloaded and installed. This behavior is not required for the invoice-validation operation itself. Installation may legitimately be documented, but executing mutable upstream content exceeds the minimum supply-chain trust necessary when immutable versions and integrity verification could be used instead. ### Attack Path 1. An attacker compromises the unpinned npm package, its publishing account, the remote skill repository, or another relevant upstream distribution channel. 2. The attacker publishes a malicious package version or modifies the remote Skill content. 3. A user follows the documented `npx skills add powmcp/skills` command. 4. `npx` resolves the package available at execution time, and the installer retrieves the mutable remote Skill source. 5. Malicious installation behavior or Skill instructions execute or become available under the invoking user's environment. 6. The payload can act with the permissions granted to the installer or later to the installed Skill and its configured tools. ### Impact Assessment Exploitation co ...[truncated 567 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` npm package to an explicitly reviewed version, for example by using an exact version rather than the latest package selected by `npx`. 2. Pin `powmcp/skills` to a verified immutable commit hash or signed release instead of a mutable repository reference. 3. Publish and verify cryptographic checksums or signatures for the package and Skill artifact before installation. 4. Use lockfiles and integrity metadata for all transitive dependencies where the installation mechanism supports them. 5. Prefer a download-and-review workflow over directly executing newly retrieved installer code. 6. Run installation with minimum privileges in a sandbox or restricted environment, and require user confirmation before granting filesystem, command-execution, credential, or network access. 7. Document the expected package version, source revision, checksum, publisher identity, and verification procedure alongside the command.