T08 · Insecure Dependencies
Error
- Location
- SKILL.md:33
- Finding
- Unpinned npm Package Execution During Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 33-39 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High ### Vulnerable Code ```markdown Use the [vercel-labs/skills](https://github.com/vercel-labs/skills) CLI to drop the `SKILL.md` into your coding agent's skills folder (Claude Code, Cursor, OpenCode, OpenClaw, etc.): ```bash npx skills add supapost-dev/skills ``` ``` ### Technical Analysis The installation procedure invokes the npm package `skills` through `npx` without specifying an exact package version or integrity hash. `npx` can download and immediately execute the version currently resolved by the npm registry. Consequently, the code executed by this command can change after the Skill has been reviewed. This creates a supply-chain boundary outside the audited project. Compromise of the package, its maintainer account, its transitive dependencies, or the registry resolution process could result in arbitrary local code execution. The command executes with the permissions of the user running the coding agent or terminal. ### Attack Path 1. An attacker compromises the referenced npm package, a maintainer account, or a transitive dependency. 2. The attacker publishes a malicious version that is selected by the unpinned `npx skills` invocation. 3. A user follows the installation instructions and runs `npx skills add supapost-dev/skills`. 4. `npx` downloads and executes the changed package. 5. The malicious package gains the invoking user's local privileges and can access files, credentials, development repositories, and network resources available to that user. ### Impact Assessment Successful exploitation permits arbitrary code execution under the invoking user's account. The resulting scope can include source-code repositories, agent configuration, environment variables, SSH or API credentials readable by that account, and any network services accessible from th ...[truncated 160 chars]
- Remediation
- ## Remediation Suggestions - Pin the installer to an explicitly reviewed version, such as `npx skills@X.Y.Z`. - Publish and verify package provenance and integrity information before execution. - Use a lockfile or otherwise pin all transitive dependencies where feasible. - Prefer downloading and inspecting the package before executing it. - Document the expected package publisher, repository, version, and checksum so users can detect substitution. - Run installation in a restricted environment without unnecessary credentials or access to sensitive repositories.