T08 · Insecure Dependencies
Warning
- Location
- README.md:22
- Finding
- Unpinned Installer and Mutable Third-Party Source## Vulnerability Details **File Location**: `README.md`, lines 22-26 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash ## Installation ```bash npx add https://github.com/wpank/ai/tree/main/skills/design-systems/design-system-components ``` ``` ### Technical Analysis The installation instructions invoke the npm package `add` through `npx` without specifying an exact package version or integrity digest. Depending on the local npm configuration and cache state, `npx` can download and execute the currently published version of that package. The installer is also directed to content hosted on the mutable `main` branch of a personal GitHub repository. Because neither the installer nor the repository content is cryptographically pinned to the versions reviewed during this audit, their behavior can change after review. This creates a supply-chain trust boundary in which compromise of the npm package, its publisher account, the GitHub account, or the upstream repository could cause users to install manipulated skill instructions or execute attacker-controlled installer behavior. The audit found no evidence that the currently documented source is malicious; the vulnerability is the unsafe, mutable installation mechanism. ### Attack Path 1. An attacker compromises the npm package used by `npx`, its publisher account, the referenced GitHub account, or the upstream repository. 2. The attacker publishes a malicious package version or modifies content on the referenced `main` branch. 3. A user follows the documented installation command. 4. `npx` retrieves the unpinned package, and the installer processes mutable remote content. 5. Malicious installer or lifecycle behavior executes with the privileges of the invoking user, or manipulated skill instructions are written into an Agent skill directory. 6. The installed content may subsequently influence Agent behavior whenever the skill is loaded. ### Impact Assessment Successful exploi ...[truncated 611 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer package to an exact, reviewed version rather than invoking an unspecified release through `npx`. 2. Verify the package using an npm lockfile, expected integrity digest, trusted provenance, and publisher-signature information where available. 3. Replace the mutable `main` branch reference with a reviewed commit hash or immutable, signed release tag. 4. Publish and verify a SHA-256 or stronger checksum for the downloaded skill content before installation. 5. Prefer a non-executing installation process, such as downloading a pinned archive, validating its checksum, and copying the reviewed files into the destination directory. 6. If an installer remains necessary, run it in a restricted environment without sensitive credentials, elevated privileges, or unnecessary filesystem access. 7. Document the expected repository owner, commit identifier, package version, and verification procedure so users can detect source substitution.