T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned External Dependencies Installed Through npx Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 14–20 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium The skill instructs the agent or user to install externally hosted prerequisite skills using `npx` and automatic confirmation: ```markdown | Skill | Description | Install | | --- | --- | --- | | `generation-diversity` | Use when writing any generative prompt — ritual seed, explicit structure, scenario axes, and quality gates before paid API calls. | `npx skills add PrunaAI/pruna-skills@generation-diversity -y` | | `video-prompting` | Use when crafting video or motion prompts for any generative model — dramaturgy, camera, physics-safe motion, frame anchors, and clip chaining. | `npx skills add PrunaAI/pruna-skills@video-prompting -y` | | `pruna-api` | Use before any Pruna or Replicate HTTP call — credentials, upload/poll/download, parallel batches, and agent safety. | `npx skills add PrunaAI/pruna-skills@pruna-api -y` | Or install the full suite once: `npx skills add PrunaAI/pruna-skills@pruna -y` ``` Additional occurrences of the same installation pattern appear in `SKILL.md` at lines 68–72 and 138–142. ### Technical Analysis The installation commands rely on an externally resolved `npx` package and mutable content from `PrunaAI/pruna-skills`. The instructions do not pin the installer or installed content to a verified immutable package version or commit hash. They also provide no checksum, signature validation, provenance verification, or local review step. The `-y` option suppresses interactive confirmation. Consequently, the effective code and skill instructions installed when the command is executed may differ from the content that was available when this project was audited. This creates a supply-chain trust boundary around the npm-resolved installer, its transitive dependencies, the remote repository, and mutable repository references. No evidence establishes that the curre ...[truncated 1644 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` installer to an exact, reviewed package version rather than allowing `npx` to resolve a mutable release. 2. Pin every prerequisite skill to an immutable, verified commit hash or content-addressed release. 3. Verify package provenance, cryptographic signatures, and checksums before installation. 4. Remove `-y` so the resolved source and version can be reviewed before installation. 5. Download and inspect dependency content in a restricted staging environment before loading it into the agent context. 6. Maintain an allowlist of approved package identities, repository owners, versions, commit hashes, and expected checksums. 7. Run installation with least privilege in a sandbox that has no API credentials and only narrowly scoped filesystem and network access. 8. Load `PRUNA_API_KEY` only after dependency installation and verification have completed. 9. Record verified dependency versions in the manifest so audited and installed content can be compared deterministically.