T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party Skill Installation Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 14-21; the same installation pattern is repeated at lines 31-33 and 78-87 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown Install and load these skills before generating (skip if already in context via `@pruna`): | Skill | Description | Install | | --- | --- | --- | | `generation-diversity` | Use when writing any generative prompt — ritual seed, explicit structure, scenario axes, and quality gates before paid API calls. | `npx skills add PrunaAI/pruna-skills@generation-diversity -y` | | `pruna-api` | Use before any Pruna or Replicate HTTP call — credentials, upload/poll/download, parallel batches, and agent safety. | `npx skills add PrunaAI/pruna-skills@pruna-api -y` | Or install the full suite once: `npx skills add PrunaAI/pruna-skills@pruna -y` ``` ### Technical Analysis The skill instructs users or agents to invoke an unversioned `npx` package and install skills from repository references that are not pinned to audited immutable commit hashes. No checksum, signature, lockfile, or equivalent integrity verification is specified. The `-y` option automatically accepts installation prompts, reducing the opportunity to inspect the resolved package, version, and source before execution. Because both the package resolved by `npx` and the referenced repository content may change independently after this skill has been reviewed, the effective installed dependency is not fully represented by the audited project. No malicious dependency is present in the reviewed artifact, and exploitation requires an upstream compromise or malicious update. Nevertheless, the installation mechanism creates a supply-chain trust boundary without adequate integrity controls. ### Attack Path 1. An attacker compromises the publishing account, package registry entry, repository, mutable reference, or distribution infrastructure ...[truncated 1556 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `npx` package to a specific, audited version rather than allowing the registry to resolve its current release. 2. Pin `PrunaAI/pruna-skills` to an immutable audited commit hash or signed release instead of mutable skill or branch references. 3. Publish and verify cryptographic checksums or signatures for downloaded skill artifacts before installation. 4. Remove `-y` from documented commands where practical so that the resolved source and version can be reviewed before installation. 5. Use a lockfile, trusted internal mirror, or vendored reviewed dependency to make installation reproducible. 6. Run installation in a sandbox with restricted filesystem, environment-variable, credential, and network access. 7. Document the expected package owner, exact versions, commit identifiers, and verification procedure. 8. Re-audit dependencies whenever their pinned versions are intentionally updated.