T08 · Insecure Dependencies
- Location
SKILL.md:23- Finding
Unpinned CLI Enables Unattended Global Installation of Third-Party Skills
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23-30, 57, 91, and 99-104
Vulnerability Type: Third-party software supply-chain exposure
Risk Level: MediumVulnerable Code
markdown The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. - `npx skills find [query]` - Search for skills interactively or by keyword - `npx skills add <package>` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skillsbash npx skills find [query]bash npx skills add vercel-labs/agent-skills@react-best-practicesmarkdown If the user wants to proceed, you can install the skill for them: ```bash npx skills add <owner/repo@skill> -g -yThe
-gflag installs globally (user-level) and-yskips confirmation prompts.text ### Technical Analysis The skill directs an agent to execute `npx skills` without pinning the npm package to an exact, reviewed version or validating its integrity. Depending on npm and `npx` behavior and the local environment, this may retrieve and execute the package version that currently resolves under the `skills` name. The CLI is then permitted to install skills from GitHub or unspecified alternative sources. The suggested installation command combines global user-level installation with `-y`, which suppresses interactive confirmation: ```bash npx skills add <owner/repo@skill> -g -yThe document recommends checking install counts, source reputation, and GitHub stars. These are useful reputation signals but do not establish package integrity or prove that the selected content is safe. They do not protect against repository compromise, malicious releases, dependency confusion, typosquatting, ownership transfer, or a formerly trustworthy project becoming compromised.
The generic
npx skills updateinstruction also permits installed content to change after its initial review wi ...[truncated 1877 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin the CLI to an exact, reviewed version rather than invoking an unconstrained package name:
bash npx --yes skills@<reviewed-exact-version> ...Validate the package name, publisher, version, and registry metadata before use.
-
Use a lockfile or equivalent integrity mechanism where supported. Verify package checksums or signatures against a trusted source before execution.
-
Restrict installation sources to an explicit allowlist of reviewed repositories and owners. Do not permit generic installation from unspecified sources.
-
Resolve skills to immutable commit hashes or signed release artifacts instead of mutable branches or tags.
-
Download and inspect the complete skill contents before installation, including scripts, lifecycle hooks, nested dependencies, external URLs, and instructions that cause additional tool execution.
-
Remove
-gand-yfrom the default workflow. Prefer isolated, project-local installation with minimal permissions. -
Require explicit, informed user approval immediately before every installation or update. Present the exact source, version or commit, requested scope, and reviewed changes.
-
Replace bulk updates with per-skill updates after reviewing release notes and content diffs. Preserve a known-good version and provide a rollback procedure.
-
Run third-party skill tooling in a sandbox with restricted filesystem, credential, process, and network access whenever possible.
-
Treat install counts, stars, and recognizable owner names only as supplemental signals, not as security verification.
-