T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:96
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 96–103 **Vulnerability Type**: Unpinned npm dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown ### Step 2: Search with intent-based queries ```bash # This is the ONLY npx command this skill executes autonomously npx skills find [intent-based query] ``` ``` ### Technical Analysis The skill instructs the agent to autonomously execute `npx skills find` without pinning the `skills` package to a reviewed version or verifying its integrity. If the package is unavailable locally, `npx` may retrieve it and its transitive dependencies from the configured npm registry before running its CLI entry point. Consequently, the code executed at invocation time is not fully represented by the audited project and may change after this skill has been reviewed. A compromised package release, dependency, publisher account, or registry could cause arbitrary package or lifecycle code to run under the invoking user's account. The fact that the intended command performs only a search does not constrain what the downloaded package itself can do. No evidence was found that the current skill intentionally selects a typosquatted or known-malicious package. The risk arises from autonomous execution of an unpinned external dependency. ### Attack Path 1. A user asks the agent to discover or recommend a skill. 2. The loaded instructions direct the agent to run `npx skills find [query]`. 3. `npx` resolves the unversioned `skills` package through the configured npm registry and may download the package and its dependency graph. 4. An attacker who has compromised the package, a transitive dependency, its publisher account, or the package-resolution infrastructure publishes malicious code. 5. `npx` executes the resolved CLI or associated lifecycle behavior with the permissions and environment of the agent process. 6. The malicious code can perform operations unrelated to registry search before returning ...[truncated 681 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the floating package reference with an exact, previously audited version, for example: ```bash npx skills@<audited-exact-version> find [intent-based query] ``` 2. Prefer declaring the CLI as a project dependency, committing a lockfile, and invoking the lockfile-controlled local executable: ```bash npx --no-install skills find [intent-based query] ``` This prevents `npx` from silently retrieving a missing package during skill execution. 3. Install dependencies in a controlled build or provisioning phase using lockfile integrity data rather than downloading executable packages during user-facing operations. 4. Verify the exact npm package identity, publisher, provenance, signatures or attestations where available, and the complete transitive dependency tree before approving a version. 5. Configure a trusted registry and consider disabling dependency lifecycle scripts where compatible with the package. 6. Require explicit user confirmation before any first-time external package retrieval, clearly stating that third-party code will be downloaded and executed. 7. Run the search utility in a restricted environment with minimal filesystem access, sanitized credentials and environment variables, limited network access, and no elevated privileges.