T08 · Insecure Dependencies
Warning
- Location
- README.md:8
- Finding
- Unpinned Executable Installer and Mutable Remote Skill Source## Vulnerability Details **File Location**: `README.md`, lines 8–11 **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and mutable remote content **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install ```bash npx skills add https://github.com/skillhq/flight-search --skill google-flights ``` ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying an exact version. Depending on the local npm environment and cache state, `npx` may download and execute the package version currently resolved from the registry. The command also installs the skill from a GitHub repository URL that is not pinned to a specific commit hash or signed release. Consequently, the content installed in the future may differ from the content audited in this project. This creates two mutable supply-chain boundaries: 1. The executable `skills` npm package is not version-pinned. 2. The remote skill source is not bound to an immutable, reviewed revision. The audit found no evidence that either dependency is currently malicious. The risk arises because compromise of the npm package, npm publisher account, GitHub repository, or repository maintainer account could change what this command executes or installs after review. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution path, GitHub repository, or a maintainer account. 2. The attacker publishes a malicious `skills` package version or modifies the repository's default branch. 3. A user follows the installation command from `README.md`. 4. `npx` resolves and executes the unpinned installer, while the installer retrieves the repository's mutable current content. 5. The malicious installer or skill content executes with the invoking user's privileges or becomes available to the user's agent. 6. Depending on the injected payload and granted tools, the attacker may access user-readable files, alte ...[truncated 803 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to an exact, audited version rather than relying on current registry resolution: ```bash npx --yes skills@X.Y.Z add ... ``` 2. Pin the skill source to a verified immutable commit SHA or a signed release rather than the repository's mutable default branch. 3. Publish and verify cryptographic checksums for the reviewed skill package and installation artifacts. 4. Prefer an installation process that downloads content without immediately executing it, allowing users to inspect the package before activation. 5. Document the expected package version, repository revision, integrity value, and verification procedure together. 6. Enable signed release tags, protected branches, mandatory review, and strong multifactor authentication for npm and repository maintainer accounts. 7. Re-audit and update the pinned versions deliberately instead of allowing dependencies to change implicitly during installation.