T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:41
- Finding
- Unpinned Third-Party Installer Permits Supply-Chain Code Execution## Vulnerability Details **File Location**: `SKILL.md`, line 41 **Vulnerability Type**: Unpinned executable dependency and mutable remote Skill source **Risk Level**: Medium **Vulnerable Code**: ```sh npx skills add powmcp/skills --skill preflight-retailer-bound-epub ``` ### Technical Analysis The documented setup command invokes `npx` without pinning the `skills` package to an audited version. Depending on the local environment and cache state, `npx` may download and execute the package currently published under that name. The `powmcp/skills` source is also identified by a mutable repository reference rather than an immutable commit. Therefore, both the installer behavior and installed Skill content can change after this project has been audited. This creates a supply-chain trust boundary in which externally controlled code or instructions may execute with the invoking user's permissions. No evidence shows that the current dependencies are malicious; the vulnerability is the absence of integrity and version controls capable of preventing future substitution. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, or mutable `powmcp/skills` repository. 2. The attacker publishes a malicious version of the installer or modifies the remotely retrieved Skill content. 3. A user follows the documented setup instruction. 4. `npx` downloads and executes the current package, or the installer retrieves the modified Skill source. 5. The malicious installer runs with the user's current privileges or installs attacker-controlled instructions for subsequent Agent use. ### Impact Assessment Successful exploitation could execute arbitrary commands with the privileges of the user running `npx`. Depending on that user's access, the attacker could read or modify accessible files, obtain environment variables or credentials, make network requests, alter installed Agent instructions, or inst ...[truncated 355 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm installer to an exact audited version, for example by using `npx --package=skills@<exact-version>`. 2. Pin `powmcp/skills` to an immutable commit identifier rather than a mutable branch or default repository reference. 3. Record and verify cryptographic hashes for downloaded installation artifacts and Skill content. 4. Review npm lifecycle scripts and prefer an installation method that does not execute unnecessary scripts. 5. Use lockfiles and integrity metadata where the installation mechanism supports them. 6. Execute installation in a restricted environment without production credentials or access to confidential publishing assets. 7. Document the expected package version, repository commit, publisher identity, and verification procedure so users can detect unexpected upstream changes.