T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned CLI Execution and Unreviewed Global Third-Party Skill Installation
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ```bash npx skills find [query] ``` ```markdown If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. ``` ### Technical Analysis The skill instructs the agent to invoke `npx skills` without specifying an exact, reviewed package version or integrity constraint. Depending on the local npm configuration and cache state, `npx` can resolve and retrieve executable package content at runtime. Consequently, the code that executes may differ from the code that was available when this skill was audited. The workflow then allows installation from “GitHub or other sources.” It does not require source allowlisting, immutable commit references, signature verification, integrity validation, or inspection of the selected skill before installation. The recommended installation command combines global user-level installation (`-g`) with automatic confirmation (`-y`), reducing opportunities to review the source and scope before it is trusted. This is a supply-chain weakness rather than evidence that the currently documented CLI or example package is malicious. Exploitation requires ...[truncated 1684 chars]- Remediation
View remediation
find ``` - Use the verified package name for the intended CLI. - Record and validate the package integrity hash through a lockfile or equivalent mechanism. 2. **Do not suppress installation approval** - Remove `-y` from installation commands. - Require explicit, informed user confirmation after displaying the source, version, requested scope, and review results. 3. **Avoid global installation by default** - Remove `-g` and install skills within an isolated project or sandbox. - Permit user-level global installation only when it is necessary and explicitly approved. 4. **Constrain third-party sources** - Maintain an allowlist of trusted owners and repositories. - Pin GitHub sources to immutable commit hashes rather than mutable branches or tags. - Reject ambiguous package names and sources that cannot provide verifiable provenance. 5. **Review before installation** - Download the candidate without executing it. - Inspect its instruction files, scripts, dependency manifests, lifecycle hooks, network behavior, and requested capabilities. - Run malware, secret, and dependency scans before allowing installation. 6. **Isolate execution** - Perform discovery and installation in a restricted environment with minimal filesystem access, sanitized environment variables, limited credentials, and controlled network access. - Prevent installation processes from accessing unrelated repositories, SSH keys, cloud credentials, and agent memory. 7. **Secure update behavior** - Do not apply unrestricted bulk updates through `npx skills update`. - Review version changes and source diffs, then update to explicitly approved versions. ]]>