T08 · Insecure Dependencies
Warning
- Location
SKILL.md:28- Finding
Unpinned CLI Execution and Unverified Global Installation of Third-Party Skills
- Content
View full analysis
` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` From `SKILL.md:88-92`: ```markdown If the user wants to proceed, you can install the skill for them: ```bash npx skills add -g -y ``` ``` The same workflow is also documented in `README-zh.md:34-41`, `README-zh.md:62-64`, and `README-zh.md:104-111`. ### Technical Analysis The skill directs the agent to execute `npx skills` without pinning the CLI package to a reviewed version. Depending on the local package-manager state, `npx` can retrieve and execute the currently published version of the named package. Consequently, the code executed at audit time may differ from the code executed later. The installation workflow accepts skill packages discovered through an external registry and explicitly supports GitHub and other unspecified sources. It does not require: - Pinning the CLI or selected skill to an immutable version or commit. - Verifying package checksums, signatures, or provenance. - Validating repository ownership against a trusted allowlist. - Reviewing package contents, scripts, or skill instructions. - Disabling or inspecting package lifecycle hooks. - Installing into an isolated, task-specific environment. The recommended `-g` option expands the installation to user-level global scope, while `-y` suppresses confirmation prompts provided by the installer. Although the document states that the user should agree before installation, no final verification step is required for the exact package source, revi ...[truncated 2182 chars]- Remediation
View remediation
`. - Maintain a controlled process for reviewing and updating the pinned version. - Use lockfiles and integrity metadata where the execution environment supports them. 2. **Pin installed skills to immutable references** - Require a reviewed release identifier or full Git commit hash. - Do not install directly from mutable branches, tags that can be moved, or unspecified latest versions. 3. **Restrict trusted sources** - Maintain an allowlist of approved repository owners, repositories, and registries. - Reject redirects and packages from unspecified “other sources.” - Verify repository ownership and package provenance before presenting a recommendation. 4. **Inspect packages before installation** - Download or clone candidate packages into an isolated temporary directory. - Review manifests, lifecycle scripts, executable files, symlinks, and skill instructions. - Scan dependencies for known vulnerabilities, typosquatting, and suspicious behavior. - Verify signatures or checksums against a trusted channel when available. 5. **Avoid unattended global installation** - Remove `-g` and `-y` from the default workflow. - Prefer project-local or sandboxed installation with minimal filesystem and network permissions. - Require a final confirmation that displays the exact source, immutable revision, integrity value, and installation destination. 6. **Apply runtime isolation** - Run discovery and installation commands in a container or restricted subprocess. - Deny access to sensitive environment variables, SSH keys, cloud credentials, and unrelated user files. - Restrict outbound network access to approved registries and repositories. 7. **Provide removal and audit controls** - Record the installed package, source repository, revision, integrity value, and installation time ...[truncated 187 chars]