T08 · Insecure Dependencies
Warning
- Location
- skill.md:43
- Finding
- Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `skill.md`, lines 43–47 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```markdown Install this reference skill: ```bash theme={null} npx skills add Lightprotocol/skills ``` ``` Related installation instructions also appear at lines 85–104: ```markdown ### Install to Claude Code Add the marketplace and install: ``` /plugin marketplace add Lightprotocol/skills /plugin install solana-rent-free-dev ``` ### Install to Cursor 1. Open Settings (**Cmd+Shift+J** / **Ctrl+Shift+J**) 2. Navigate to **Rules & Commands** → **Project Rules** → **Add Rule** → **Remote Rule (GitHub)** 3. Enter: `https://github.com/Lightprotocol/skills.git` Skills are auto-discovered based on context. Ask about light-token, defi, payments, or program migration and the agent uses the relevant skill automatically. ### Install to Any Agent ``` npx skills add Lightprotocol/skills ``` ``` ### Technical Analysis The documented commands execute an npm-resolved `skills` CLI and install Skill content from a mutable GitHub repository without pinning either source to an audited version. The `npx` invocation does not identify an exact CLI package version, while the repository references do not specify a commit SHA or signed release. As a result, the effective installation behavior and installed content can change after this file has been audited. Although the document advises users to verify the source, no checksum, signature, immutable reference, or enforced review step protects the installation process. This is a supply-chain issue rather than evidence that the currently reviewed Markdown file contains a malicious payload. The risk becomes exploitable if the npm package, GitHub repository, maintainer account, release process, or default branch is compromised or modified maliciously. ### Attack Path 1. An attacker compromi ...[truncated 1316 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to an audited exact version rather than allowing `npx` to resolve the current release. 2. Pin the GitHub source to a reviewed commit SHA or immutable, signed release tag. 3. Publish cryptographic checksums or signatures and verify them before installation. 4. Require explicit user confirmation after displaying the exact package version, repository revision, and files to be installed. 5. Avoid automatically loading newly retrieved Skills until their instructions and executable components have been reviewed. 6. Run installation and Skill execution with minimum privileges, restricting filesystem, network, credential, and command-execution access to what the declared development-documentation function requires. 7. Document a trusted update process that requires renewed review whenever the pinned dependency or repository revision changes.