T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:23
- Finding
- Unpinned Third-Party CLI Enables Unsafe Supply-Chain Execution## Vulnerability Details **File Location**: `SKILL.md:23-29` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium **Complete Code Snippet**: ```markdown **Key commands:** - `npx skills find [query]` - Search for skills interactively or by keyword - `npx skills add <package>` - Install a skill from GitHub or other sources - `npx skills check` - Check for skill updates - `npx skills update` - Update all installed skills ``` ### Technical Analysis The skill directs the agent to invoke the `skills` package through `npx` without specifying an immutable package version or verifying package integrity. If the package is not already present in the local cache, `npx` may retrieve it from the configured npm registry and execute it. Consequently, the code executed at invocation time can differ from the code that existed when this skill was audited. The documented `add` and `update` operations also accept mutable content from GitHub or unspecified “other sources.” Popularity indicators such as install counts and GitHub stars do not provide cryptographic integrity, source authenticity, or protection against a legitimate upstream account being compromised. ### Attack Path 1. An attacker compromises the upstream `skills` npm package, its publisher account, a configured package registry, or a skill source accepted by the CLI. 2. The attacker publishes a malicious version or replaces mutable upstream skill content. 3. A user asks the agent to discover, install, or update a skill. 4. Following `SKILL.md`, the agent executes an unversioned `npx skills` command. 5. `npx` retrieves and runs the current upstream package, or the CLI retrieves the compromised skill. 6. Attacker-controlled installation logic or skill instructions execute within the permissions of the invoking user. ### Impact Assessment Exploitation could obtain the privileges of the user running the agent or CLI. Depending on the be ...[truncated 391 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an explicitly reviewed version, such as `npx skills@<approved-version>`, rather than resolving the latest mutable release. 2. Lock installed skills to immutable release identifiers or reviewed commit hashes. 3. Restrict installation sources to an explicit allowlist of trusted repositories and owners; remove support for unspecified sources. 4. Verify package integrity, provenance, and signatures where the ecosystem supports them. 5. Download and inspect skill contents before installation, including scripts, hooks, dependencies, and instruction files. 6. Separate search from installation so discovery never implicitly authorizes execution. 7. Require explicit user approval for every installation and update. 8. Run package discovery and inspection in a sandbox with minimal filesystem, credential, and network access.