T08 · Insecure Dependencies
- Location
SKILL.md:42- Finding
Unpinned npm CLI Executes Against a Mutable Third-Party Repository
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:42, with the same command duplicated inREADME.md:53,README.zh-CN.md:53, andclawhub-copy.md:14
Vulnerability Type: Supply-chain risk caused by unpinned executable tooling and a mutable remote source
Risk Level: MediumVulnerable Code
bash npx skills add https://github.com/sirsws/akm --skill akm-fitness-planner --full-depthTechnical Analysis
The installation command does not pin the
skillsnpm CLI to an exact reviewed version. Depending on the local environment and npm cache,npxmay retrieve and execute the package version currently resolved by the npm registry.The GitHub source is also specified as a mutable repository URL rather than an immutable commit SHA or verified release artifact. Therefore, the installed content can change after this project snapshot has been reviewed. The
--full-depthoption may also retrieve more repository content than the minimum Skill directory, increasing the amount of unaudited material entering the installation process.No malicious package, payload, or executable script was found in the supplied project. This finding concerns the trust and integrity of the documented future installation path, not confirmed malicious behavior in the audited files.
Attack Path
- An attacker compromises the npm account or distribution channel associated with the unpinned
skillsCLI, or compromises the referenced GitHub account or repository. - The attacker publishes modified CLI behavior or changes repository content after this snapshot was audited.
- A user follows the documented installation command.
npxresolves and executes the then-current CLI package.- The CLI retrieves content from the mutable repository reference, potentially including content that was not part of this audit.
- The altered installer or imported Skill content executes or influences the agent with the user's available pri ...[truncated 767 chars]
- An attacker compromises the npm account or distribution channel associated with the unpinned
- Remediation
View remediation
Remediation Suggestions
-
Pin the npm CLI to an exact reviewed version:
bash npx skills@<exact-reviewed-version> add ... -
Replace the mutable repository reference with an immutable, reviewed commit SHA or signed release tag supported by the installer.
-
Publish a checksum or cryptographic signature for the expected Skill artifact and verify it before installation.
-
Remove
--full-depthunless full repository traversal is strictly required. Retrieve only the specific Skill directory and necessary files. -
Document the exact npm package version, repository commit, and expected artifact digest used during security review.
-
Apply the corrected command consistently in
SKILL.md,README.md,README.zh-CN.md, andclawhub-copy.md. -
Consider installing the CLI as a reviewed dependency under a lockfile rather than allowing
npxto resolve tooling dynamically.
-