T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:89
- Finding
- Unpinned Third-Party Package Execution in Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:89` **Vulnerability Type**: Unpinned and externally mutable npm dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the third-party `skills` npm package through `npx` without specifying an exact version or verifying an integrity digest. Consequently, the code executed by this command is resolved from the configured npm registry at installation time and may differ from the code that existed when this project was audited. The reviewed repository neither contains the `skills` package implementation nor constrains its version, integrity, registry source, or lifecycle behavior. Because `npx` can download and execute npm package code, compromise of the package, its dependencies, its publisher account, or the selected registry could result in execution of attacker-controlled code. The `-g` option also requests a global Skill installation, increasing the persistence and scope of any malicious Skill content installed by a compromised dependency. ### Attack Path 1. An attacker compromises the npm package, one of its transitive dependencies, its publisher account, or the package source selected through dependency confusion or registry manipulation. 2. The attacker publishes a malicious version containing installation-time or runtime code. 3. A user follows the installation instructions and executes: ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` 4. `npx` resolves and downloads the mutable package version from the configured registry. 5. The malicious package executes with the privileges of the invoking user. 6. It may access user-readable files, alter user-owned configuration, install malicious Skill instructions globally, or perform network operations permitted to that user. This exploitation path depends on compromise or malicious replac ...[truncated 666 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the installer to a specific, reviewed version rather than resolving the latest package: ```bash npx --yes skills@<audited-version> add zhaoxinghua09-cell/agent-skills ``` 2. Lock and verify the expected package integrity digest. Publish the package name, version, registry URL, and SHA-512 integrity value in the installation documentation. 3. Audit the selected package and its complete transitive dependency tree before recommending execution. 4. Avoid global installation by default. Install into a project-scoped or isolated directory and require explicit user approval before copying content into a global Agent Skill directory. 5. Run installation with least privilege and explicitly warn users not to invoke the command through `sudo`, an administrator shell, or another elevated context. 6. Prefer a repository-contained, reviewable installation procedure that copies known files without executing remotely resolved package code. 7. If `npx` remains necessary, use a trusted registry explicitly and apply organizational package allowlisting, lockfiles, provenance verification, and registry signature controls where available. ]]>