T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:46
- Finding
- Unpinned Remote Dependencies in Documented Installation Command## Vulnerability Details **File Location**: `SKILL.md`, lines 46-50 **Vulnerability Type**: Unpinned third-party CLI and mutable GitHub dependency **Risk Level**: Medium ### Vulnerable Code ```markdown Skills CLI: ```bash npx skills add https://github.com/sirsws/dae-persona-context-injector --skill dae-persona-context-injector ``` ``` ### Technical Analysis The documented installation command invokes the `skills` package through `npx` without specifying a reviewed package version. It also installs the Skill from a GitHub repository URL without pinning the source to an immutable commit hash or signed release. As a result, the code retrieved when a user runs this command may differ from the code reviewed during this audit. `npx` can download and execute package code, while a repository's default branch can be modified after publication. Compromise of the npm package, its maintainer account, the GitHub account, or the repository could therefore turn the documented installation workflow into a supply-chain execution vector. The project does not contain evidence that this command runs automatically. Exploitation requires a user or automation system to execute the documented installation command. ### Attack Path 1. An attacker compromises the unpinned `skills` package, its publishing account, the referenced GitHub account, or the repository's mutable default branch. 2. The attacker publishes or commits a modified installer, Skill package, lifecycle script, or other executable content. 3. A user follows the installation instructions and runs the documented `npx skills add ...` command. 4. `npx` retrieves the current CLI package, and the CLI retrieves content from the mutable GitHub reference. 5. The malicious component executes during installation or installs attacker-controlled Skill content. 6. The payload operates with the permissions of the user or automation account that launched the command. ### Impact Assess ...[truncated 630 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI package to a specifically reviewed version rather than allowing `npx` to resolve the latest release, for example by using an exact version such as `npx skills@X.Y.Z`. 2. Replace the mutable GitHub repository reference with an immutable, reviewed commit hash or signed release tag. 3. Prefer a release artifact with a published SHA-256 checksum and instruct users to verify its integrity before installation. 4. Avoid relying on unsigned mutable branch content in installation documentation. 5. Document the expected package publisher, repository owner, release identifier, and checksum so users can validate provenance. 6. Review the pinned CLI and repository revision for lifecycle scripts or other installation-time execution before recommending them. 7. Where supported, run installation in a restricted environment with least-privilege filesystem, credential, and network access.