T08 · Insecure Dependencies
- Location
README.md:9- Finding
Unpinned Third-Party Installer Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 9-11
Vulnerability Type: Unpinned and unverified third-party installer execution
Risk Level: MediumVulnerable Code:
bash npx skills add oss-skills/upstream-reconTechnical Analysis
The documented installation procedure invokes the third-party
skillsnpm package throughnpxwithout specifying an immutable package version or verifying its integrity. If the package is not already available locally,npxcan retrieve it from the configured npm registry and execute its package-controlled code under the current user's account.Because neither the installer package nor the referenced skill source is pinned to a reviewed immutable release or commit, the code executed by this command can change after the project has been audited. Compromise of the npm package, its publisher account, the package registry path, or the referenced upstream source could therefore turn the documented installation command into a supply-chain delivery mechanism.
The audit found no evidence that the current project intentionally distributes a malicious package or payload. The vulnerability is the unsafe trust model of the recommended installation path.
Attack Path
- An attacker compromises the npm package, its publisher account, or another source used by the
skillsinstaller. - The attacker publishes a modified release containing malicious installer or lifecycle behavior, or alters the mutable skill source resolved by the command.
- A user follows the README and runs
npx skills add oss-skills/upstream-recon. npxretrieves and executes the mutable third-party package without an explicit reviewed version or integrity check.- The malicious installer runs with the invoking user's privileges and can alter files or install attacker-controlled skill content.
Impact Assessment
Successful exploitation could provide code execution with the privile ...[truncated 502 chars]
- An attacker compromises the npm package, its publisher account, or another source used by the
- Remediation
View remediation
Remediation Suggestions
- Pin the
skillsnpm installer to a reviewed, explicit version rather than resolving the latest mutable release. - Pin the installed skill to an immutable commit hash or cryptographically verified release artifact where supported.
- Publish expected checksums or signatures and instruct users to verify downloaded content before installation.
- Use a lockfile and npm integrity metadata when incorporating the installer into automated workflows.
- Recommend reviewing and manually copying the skill files as the safer installation option.
- Document the authoritative npm package and source repository so users can detect typosquatting or source substitution.
- Advise users not to execute the installer as root or another privileged account and to use an isolated environment when practical.
A hardened command should use an explicitly reviewed installer version, for example:
bash npx --yes skills@<reviewed-version> add oss-skills/upstream-recon@<immutable-reference>The exact syntax should be validated against the installer's supported version and source-pinning features.
- Pin the