T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Third-Party Installation Command Enables Supply-Chain Substitution## Vulnerability Details **File Location**: `SKILL.md`, line 39 **Vulnerability Type**: Unpinned executable dependency and mutable Skill source **Risk Level**: Medium ### Vulnerable Code ```text npx skills add powmcp/skills --skill verify-payment-page-header-change-after-deploy ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying an exact package version. It also identifies the `powmcp/skills` source without pinning it to an immutable commit, signed release, or integrity hash. Running an unpinned package through `npx` can download and execute a newer package version than the one reviewed during this audit. The installed Skill content can likewise change after review because its source is mutable. A compromise, malicious release, dependency-confusion event, or unauthorized upstream modification could therefore cause users to execute installer logic or load Skill instructions that were not included in the audited artifact. This is a supply-chain exposure rather than evidence that the current package or repository is malicious. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, the referenced Skill repository, or another relevant upstream distribution channel. 2. The attacker publishes a modified package version or changes the mutable Skill source. 3. A user follows the documented command after that change. 4. `npx` retrieves and executes the currently resolved package rather than a specifically audited version. 5. The installer retrieves or installs the attacker-controlled Skill content. 6. Malicious installer code executes with the invoking user's privileges, or altered Skill instructions influence subsequent Agent sessions. ### Impact Assessment Successful exploitation could execute arbitrary code with the permissions of the user running `npx`. Depending on that user's environment, this may expose accessi ...[truncated 503 chars]
- Remediation
- ## Remediation Suggestions - Pin the `skills` npm package to a reviewed exact version rather than allowing `npx` to resolve the latest available release. - Pin the `powmcp/skills` source to an immutable commit digest or cryptographically signed release. - Verify package integrity through lockfiles, registry integrity metadata, checksums, or signatures before execution. - Prefer installing dependencies in a controlled build step and reviewing them before use instead of executing newly downloaded packages directly. - Use a trusted private registry or an approved dependency proxy where appropriate. - Run installation with a minimally privileged account in a sandbox that has no production credentials or unnecessary filesystem access. - Add automated dependency monitoring and require review when either the installer package or Skill source changes. - Document the exact audited package version, repository commit, and expected integrity value in `SKILL.md`.