T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:44
- Finding
- Unpinned Remote Skill Suite Installation## Vulnerability Details **File Location**: `SKILL.md:44-50` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install ```bash npx skills add PrunaAI/pruna-skills@pruna -y ``` After install, start a **new chat**. Your agent picks skills from the suite by name. ``` Similar installation commands are repeated for individual suite components in the tables that follow. ### Technical Analysis The documented installation command invokes the `skills` package through `npx` and installs Skill content from the remote `PrunaAI/pruna-skills` repository. Neither the command-line package nor the repository content is pinned to an immutable, reviewed version or commit, and no checksum or signature verification is specified. The `-y` option also suppresses interactive confirmation. Consequently, the content installed at execution time can differ from the content originally reviewed. The advertised suite contains 29 guide, tool, and workflow dependencies, but those dependency contents are not included in this project and therefore could not be audited. This creates a supply-chain trust boundary in which compromise or unauthorized modification of the package registry entry, repository, mutable reference, or downstream Skill content could expose users to attacker-controlled instructions or executable components. ### Attack Path 1. An attacker compromises, gains publishing access to, or otherwise modifies a remote package or repository component resolved by the installation command. 2. The attacker adds malicious Skill instructions, tool definitions, or executable content to the remotely resolved suite. 3. A user follows the documented command, and `npx` resolves the unpinned CLI while the installer retrieves the mutable remote Skill content. 4. The `-y` option allows installation to proceed without an explicit confirmation checkpoint. 5. The user start ...[truncated 970 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` CLI to a specific reviewed version rather than allowing `npx` to resolve the current release dynamically. 2. Pin `PrunaAI/pruna-skills` to an immutable Git commit or cryptographically immutable release artifact instead of a mutable Skill reference. 3. Publish a dependency lock file or equivalent manifest covering every transitive guide, tool, and workflow dependency. 4. Provide and verify cryptographic checksums or signatures before installation. 5. Remove `-y` from security-sensitive installation instructions, or display the exact source, revision, dependency set, and requested capabilities before confirmation. 6. Vendor reviewed Skill contents into the release when practical so that the audited artifact matches the installed artifact. 7. Review all 29 referenced dependencies for external downloads, executable scripts, credential handling, shell commands, and tool permissions before recommending installation. 8. Run installed Skills with least privilege, restricting filesystem access, network destinations, environment variables, API credentials, and executable tools to those required for the requested workflow.