T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned npx Package Execution Creates a Mutable Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 42 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```sh npx skills add powmcp/skills --skill gate-published-release-before-announcement ``` ### Technical Analysis The documented installation command invokes the third-party `skills` package through `npx` without specifying an exact package version or integrity value. If the package is absent locally, `npx` may retrieve its currently published release and execute its command-line entry point. Because the dependency is mutable, the code executed when a user follows this instruction can differ from the code that was available when this Skill was audited. The `powmcp/skills` repository reference is also not tied to an immutable commit, further reducing reproducibility. This exceeds the minimum behavior necessary to install static Skill content because installation depends on executing remotely maintained code whose future contents are not constrained by the audited project. ### Attack Path 1. An attacker compromises the npm account, publishing process, or upstream source associated with the unpinned `skills` package. 2. The attacker publishes a modified version containing a malicious command-line payload. 3. A user follows the installation command from `SKILL.md`. 4. `npx` resolves and downloads the attacker-controlled current package version. 5. The package entry point executes under the invoking user's account. 6. The payload can access resources available to that user, subject to operating-system permissions and environmental restrictions. Compromise of the mutable repository reference could also cause unexpected Skill content to be installed, depending on how the external installer retrieves and processes that repository. ### Impact Assessment Successful exploitation of the `npx` execution path could run arbitrary code with the privileges of ...[truncated 463 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer to an explicitly reviewed package version, for example by using an exact version rather than the latest available release. 2. Pin the referenced repository to an immutable commit identifier instead of a mutable owner/repository reference, if the installer supports commit-qualified sources. 3. Verify package integrity through a lockfile, cryptographic digest, signed release, or equivalent trusted-publishing mechanism. 4. Prefer an installation method that copies reviewed static Skill files without executing a remotely downloaded package. 5. Document the expected package version, repository commit, file inventory, and verification procedure so users can reproduce the reviewed installation. 6. Run any unavoidable installer in a least-privileged, isolated environment without unrelated credentials or sensitive environment variables.