T08 · Insecure Dependencies
Warning
- Location
SKILL.md:88- Finding
Unpinned Third-Party CLI Execution and Global Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` `SKILL.md:88-96`: ```markdown ### Step 4: Offer to Install If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. ``` ### Technical Analysis The skill instructs the agent to invoke `npx skills` without specifying an exact package version or validating package integrity. If the CLI is not already available locally, `npx` may retrieve and execute the currently resolved package from the configured npm registry. Consequently, the code executed can differ from the version originally reviewed. The workflow then permits skills returned by an external search service to be installed from GitHub or other sources. The installation command uses `-g`, which installs the selected skill at user scope, and `-y`, which suppresses interactive confirmation. No controls require verification of the repository owner, review of downloaded content, validation of checksums or signatures, or pinning to an immutable commit. This creates a supply-chain trust boundary in which mutable third-party packages and search results can influence locally executed commands and globally installed agent instructions. ### Attack Path 1. An attacker publishes a malicious or typo-squatted package, compromises the unpinned `skills` CLI, compromises a listed skill repository, or causes a malicious repository to appear in search results. 2. A user asks the agent to locate ...[truncated 1182 chars]- Remediation
View remediation
`, and enforce lockfile or integrity verification where supported. 2. Restrict installations to an allowlist of verified publishers and repositories. 3. Pin installed skills to immutable commit hashes or signed release artifacts rather than mutable branches or tags. 4. Download and inspect skill contents before installation, including scripts, lifecycle hooks, executable files, external downloads, and instruction text. 5. Verify checksums or cryptographic signatures for downloaded artifacts. 6. Remove `-g` by default and install into an isolated, task-specific environment with minimal permissions. 7. Remove `-y` from the default workflow. Present the exact source, resolved revision, requested scope, and reviewed contents before obtaining explicit user confirmation. 8. Run discovery and installation tooling in a sandbox without access to sensitive credentials or unrelated user files. 9. Disable package lifecycle scripts where feasible and monitor installation output for unexpected network access or command execution. ]]>