T08 · Insecure Dependencies
Warning
- Location
- README.md:18
- Finding
- Unpinned Third-Party Installer and Skill Source## Vulnerability Details **File Location**: `README.md`, lines 18-20 **Vulnerability Type**: Unpinned third-party installation dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add hooked-so/hooked-skill ``` ### Technical Analysis The documented installation command uses `npx` to obtain and execute the `skills` package without specifying a verified version. It also identifies the Skill through a mutable repository reference rather than an immutable commit or signed release. Consequently, the components installed or executed when this command is run can differ from those reviewed during this audit. If the npm package, its dependency chain, its publishing account, or the referenced repository is compromised, the installation process could deliver modified instructions or execute malicious installer behavior under the invoking user's account. The audited artifact itself contains no bundled dependencies, lifecycle scripts, or executable source code. The risk specifically arises from the mutable external supply chain used by the documented installation procedure. ### Attack Path 1. An attacker compromises the unversioned `skills` npm package, one of its dependencies, its publisher account, or the `hooked-so/hooked-skill` upstream repository. 2. The attacker publishes a malicious package version or changes the mutable repository content. 3. A user follows the documented command: ```bash npx skills add hooked-so/hooked-skill ``` 4. `npx` retrieves the currently available installer rather than a previously audited, pinned version. 5. The installer retrieves the current repository content rather than an immutable reviewed revision. 6. Malicious installation code may run with the user's privileges, or altered Skill instructions may be installed and subsequently loaded by the user's AI agent. ### Impact Assessment Successful exploitation could permit arbitrary actions within the privileges of the user running the installation c ...[truncated 507 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` npm package to a reviewed exact version: ```bash npx skills@X.Y.Z add hooked-so/hooked-skill ``` 2. Pin the Skill source to an immutable commit hash or cryptographically signed release instead of a mutable repository branch. 3. Publish checksums or signatures for released Skill artifacts and document how users can verify them before installation. 4. Use npm lockfiles and integrity metadata where applicable to constrain transitive dependencies. 5. Document a manual installation option that downloads a specific release artifact, verifies its checksum, and installs only the reviewed `SKILL.md`. 6. Avoid recommending elevated execution and explicitly instruct users not to run the installer with administrator or root privileges. 7. Establish release signing, protected branches, mandatory review, and multi-factor authentication for npm and repository publisher accounts.