T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party Package Installation Commands## Vulnerability Details **File Location**: `SKILL.md`, lines 16–20 **Vulnerability Type**: Supply-chain risk from unpinned remote dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown | `generation-diversity` | Use when writing any generative prompt — ritual seed, explicit structure, scenario axes, and quality gates before paid API calls. | `npx skills add PrunaAI/pruna-skills@generation-diversity -y` | | `image-prompting` | Use when crafting still-image prompts for any generative model — composition, identity sheets, edits, try-on, and photoreal personas. | `npx skills add PrunaAI/pruna-skills@image-prompting -y` | | `pruna-api` | Use before any Pruna or Replicate HTTP call — credentials, upload/poll/download, parallel batches, and agent safety. | `npx skills add PrunaAI/pruna-skills@pruna-api -y` | Or install the full suite once: `npx skills add PrunaAI/pruna-skills@pruna -y` ``` ### Technical Analysis The skill instructs users or agents to invoke `npx` and install content from the remote `PrunaAI/pruna-skills` repository without pinning the `npx` CLI package or the remote repository to an immutable release or commit hash. The symbolic selectors such as `@generation-diversity` identify skill content but do not establish an immutable, cryptographically verified dependency version. `npx` can retrieve and execute package code during invocation. Consequently, the code that runs at installation time may differ from the code reviewed during this audit. The `-y` option suppresses interactive confirmation, further reducing the opportunity to inspect an unexpected package or changed dependency before execution. No evidence was found that the referenced dependencies are currently malicious. The vulnerability is the unsafe dependency acquisition pattern and the resulting exposure to repository compromise, account takeover, malicious package publication, dependency confusion, or an upstream supply-chain incident. ### Attack Path 1. An attacker com ...[truncated 1389 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `npx` CLI package to a reviewed, exact version rather than allowing `npx` to resolve the latest available release. 2. Pin `PrunaAI/pruna-skills` to an immutable commit hash or cryptographically signed release instead of a mutable selector. 3. Verify downloaded content against a trusted checksum or signature before installation. 4. Remove `-y` from security-sensitive installation instructions so users can review the resolved source and version. 5. Prefer a lockfile-backed installation workflow with integrity metadata where the tooling supports it. 6. Document the expected repository owner, immutable revision, package digest, and verification procedure. 7. Run dependency installation in a sandbox with minimal filesystem access, no unnecessary secrets, restricted outbound networking, and non-administrative privileges. 8. Review and update pinned revisions through a controlled dependency-update process that includes source review and automated supply-chain scanning.