T08 · Insecure Dependencies
Warning
- Location
SKILL.md:8- Finding
Unpinned Third-Party Package Execution During Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:8-11
Vulnerability Type: Supply-chain risk caused by mutable, unpinned dependencies
Risk Level: MediumVulnerable Code
markdown ## Install ```bash npx skills add pskoett/pskoett-ai-skills/dx-data-navigatortext ### Technical Analysis The installation instructions invoke `npx` without pinning the `skills` package to an exact, audited version. Depending on the local environment and package cache, `npx` may download and execute the package currently resolved by the registry. The referenced Skill source is also identified by a mutable repository path rather than an immutable commit. Consequently, both the installer and the content it retrieves may change after this version of the project has been reviewed. A compromise of the package registry entry, a maintainer account, or the upstream repository could turn the documented installation command into a code-execution or malicious-Skill delivery channel. No evidence establishes that the current package or repository is malicious. The vulnerability is the absence of version pinning and integrity verification at the trust boundary. ### Attack Path 1. An attacker compromises the registry package, its publisher account, or the mutable upstream Skill repository. 2. The attacker publishes a malicious package version or replaces the upstream Skill content. 3. A user follows the documented installation instructions and runs the unpinned `npx` command. 4. `npx` resolves and downloads the attacker-controlled package version, or the installer retrieves modified upstream content. 5. The package executes with the privileges of the user running the installation. 6. The attacker may execute commands available to that user or install modified Skill instructions that affect later agent sessions. ### Impact Assessment Successful exploitation may provide arbitrary code execution under the installing user's account. The resulting scope includes files, env ...[truncated 480 chars]- Remediation
View remediation
Remediation Suggestions
- Pin the
skillsCLI to an exact, reviewed version rather than relying on the registry's current resolution:bash npx --yes skills@<audited-exact-version> add ... - Pin the Skill source to an immutable commit digest or signed release instead of a mutable repository path.
- Verify package and Skill integrity using trusted checksums, provenance attestations, or cryptographic signatures before execution.
- Use a lockfile-backed or internally mirrored installation process with approved package versions.
- Run installation with a dedicated, least-privileged account that has no production credentials or unnecessary filesystem access.
- In CI environments, disable implicit dependency updates and permit outbound access only to approved registries and repositories.
- Re-audit the resolved installer package and exact upstream commit before distributing the installation command.
- Pin the