T08 · Insecure Dependencies
- Location
README.md:135- Finding
Unpinned npx Installation Command Introduces Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Location:
README.md, line 135
Vulnerability Type: Unpinned third-party package execution
Risk Level: MediumVulnerable code snippet:
bash npx skills add swif698/jiaoyuan.skillTechnical Analysis
The documented installation command invokes the
skillsnpm package throughnpxwithout specifying an exact package version or integrity constraint. If the package is not already available locally,npxmay retrieve and execute the version currently resolved by the configured npm registry.This makes installation behavior dependent on mutable third-party infrastructure rather than the reviewed project contents. A compromised npm package, maintainer account, registry response, or future malicious release could cause users to execute code different from the code audited here. The referenced Skill source is also identified by a mutable repository name rather than an immutable commit in this command.
No malicious behavior was found in the repository's own validation script. The issue is the unsafe dependency acquisition pattern presented to users.
Attack Path
- An attacker compromises the npm package or account associated with the unpinned
skillscommand, or otherwise controls package resolution through a malicious registry configuration. - The attacker publishes a release containing malicious installation or runtime behavior.
- A user follows the Quick Start documentation and executes
npx skills add swif698/jiaoyuan.skill. npxresolves and downloads the attacker-controlled package version.- The malicious package executes with the privileges of the user running the command.
- Depending on those privileges, it could access user-readable files, alter the user's Agent Skills directory, steal development credentials, or modify other user-owned resources.
Impact Assessment
Exploitation requires a user to run the documented command and an attacker ...[truncated 362 chars]
- An attacker compromises the npm package or account associated with the unpinned
- Remediation
View remediation
Remediation Suggestions
- Pin the installer package to a reviewed exact version, for example
npx skills@X.Y.Z add .... - Document the expected package publisher, version, checksum, and provenance so users can verify what will execute.
- Pin the Skill source to an immutable commit or signed release tag rather than relying only on a mutable repository identifier.
- Prefer a package manager mode that requires an existing lockfile and verifies integrity metadata.
- Where compatible with the installer, disable npm lifecycle scripts during acquisition and explicitly run only reviewed entry points.
- Provide a manual installation method using a specific release archive and published SHA-256 checksum.
- Use signed releases, protected maintainer accounts with multi-factor authentication, and automated dependency provenance verification.
- Pin the installer package to a reviewed exact version, for example