T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Unpinned Runtime Dependencies Enable Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md`, lines 17-22 **Vulnerability Type**: Unpinned npm runner and mutable GitHub-hosted skill dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown | `generation-diversity` | Use when writing any generative prompt — ritual seed, explicit structure, scenario axes, and quality gates before paid API calls. | `npx skills add PrunaAI/pruna-skills@generation-diversity -y` | | `video-prompting` | Use when crafting video or motion prompts for any generative model — dramaturgy, camera, physics-safe motion, frame anchors, and clip chaining. | `npx skills add PrunaAI/pruna-skills@video-prompting -y` | | `audio-prompting` | Use when crafting TTS, music, or bed prompts for any generative audio model — director style, song structure, and post-production layering. | `npx skills add PrunaAI/pruna-skills@audio-prompting -y` | | `pruna-api` | Use before any Pruna or Replicate HTTP call — credentials, upload/poll/download, parallel batches, and agent safety. | `npx skills add PrunaAI/pruna-skills@pruna-api -y` | Or install the full suite once: `npx skills add PrunaAI/pruna-skills@pruna -y` ``` Equivalent unpinned installation commands also appear at `SKILL.md:67-72` and `SKILL.md:205-212`. ### Technical Analysis The documented prerequisite workflow invokes the `skills` npm package through `npx` without specifying an audited package version. It then installs skill content from `PrunaAI/pruna-skills` using symbolic skill selectors rather than immutable repository commit hashes. The `-y` option suppresses interactive confirmation. Consequently, the code and instructions executed or loaded at installation time can differ from what was reviewed. A malicious npm release, compromised upstream repository, compromised maintainer account, or unauthorized modification of a mutable dependency could inject arbitrary code or hostile agent instructions into the installation process. No checksum, ...[truncated 1563 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` npm runner to a reviewed exact version, for example `npx skills@X.Y.Z`, rather than allowing `npx` to resolve the latest release. 2. Pin every external skill dependency to an immutable, reviewed commit hash or signed release tag. 3. Record and verify cryptographic checksums or provenance signatures before installing external content. 4. Use a lockfile or equivalent dependency manifest that captures all resolved versions and integrity metadata. 5. Remove `-y` where practical so users can inspect the package and source before installation. 6. Run installation in a sandbox or least-privileged environment with restricted filesystem, credential, and network access. 7. Periodically review pinned dependencies and update them through a controlled process that includes source inspection and integrity verification.