T08 · Insecure Dependencies
Warning
- Location
- references/Setup.md:26
- Finding
- Unpinned npx Package and Mutable Remote Skill Source<![CDATA[ ## Vulnerability Details **File Location**: `references/Setup.md:26-32` **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installing Agent Skill You can install the ColorKit skill for your CLI agent to get expert guidance directly in your terminal: ```bash npx skills add https://github.com/SzpakKamil/AgentSkills --skill ColorKit ``` ``` ### Technical Analysis The documented command invokes `npx` with the unversioned `skills` package. If that package is not already installed locally, `npx` may retrieve and execute it from the configured npm registry. Because no exact package version or integrity value is specified, the executable implementation can change after this Skill has been reviewed. The command also supplies a mutable GitHub repository URL without pinning it to a reviewed commit. Consequently, the content installed as the ColorKit Skill may differ over time. Compromise of the npm package, one of its transitive dependencies, the GitHub repository, or the associated maintainer accounts could introduce attacker-controlled code or Skill instructions. There is no evidence in the audited files that the current package or repository is malicious. The vulnerability is the unpinned remote execution and installation path, which prevents the reviewed artifact from guaranteeing the behavior of the subsequently retrieved components. ### Attack Path 1. An attacker compromises the npm `skills` package, a transitive dependency, the GitHub repository, or a relevant publisher account. 2. The attacker publishes a malicious package version or modifies the mutable repository content. 3. A user follows the documentation and runs the provided `npx skills add ...` command. 4. `npx` retrieves and executes the unreviewed package version under the user's account. 5. The package retrieves or installs the attacker-controlled Skill content. 6. Depending on the behavior of the compromised ...[truncated 898 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI package to an exact, reviewed version rather than relying on the latest registry release: ```bash npx --yes skills@<reviewed-exact-version> add <pinned-source> --skill ColorKit ``` 2. Pin the GitHub source to a specific reviewed commit or immutable release artifact if the installer supports that syntax. 3. Record and verify package integrity hashes or signatures before execution. 4. Prefer installing a reviewed CLI package through a lockfile-based project dependency and invoking its local binary instead of allowing `npx` to download an arbitrary current release. 5. Document the expected npm publisher, repository owner, exact version, commit identifier, and verification procedure. 6. Advise users to run the installer without administrative privileges and in an isolated environment where practical. 7. Avoid recommending mutable branches such as `main` for the ColorKit Swift dependency; use an exact reviewed release or commit instead. ]]>