T08 · Insecure Dependencies
Error
- Location
- SKILL.md:87
- Finding
- Unpinned Package Execution in Installation Instructions## Vulnerability Details **File Location**: `SKILL.md:87-90` **Vulnerability Type**: Supply-chain exposure through unpinned external packages and mutable repositories **Risk Level**: High ```bash npx skills add zhaoxinghua09-cell/agent-skills -g git clone https://github.com/zhaoxinghua09-cell/agent-skills.git ``` ### Technical Analysis The documented one-line installation uses `npx` without specifying an exact package version, integrity digest, lockfile, or verified publisher identity. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the currently resolved version of the `skills` package. The alternative installation method clones a mutable branch rather than a reviewed commit. Consequently, the content installed by either command may differ from the content that was audited. The global installation option also increases the scope of any compromised package or repository content. This issue affects the documented installation path rather than the audited Python runtime, which itself has no third-party dependencies. ### Attack Path 1. An attacker compromises, replaces, or otherwise influences the npm package resolved as `skills`, or compromises the referenced repository. 2. The remote package or repository is modified after this Skill package has been reviewed. 3. A user follows the installation command from `SKILL.md`. 4. `npx` retrieves and executes the mutable package, or Git clones mutable repository content. 5. Attacker-controlled installation logic or Skill files run with the invoking user's permissions and may be installed globally. ### Impact Assessment Successful exploitation can execute code with the privileges of the user running the installation command. The global installation option may modify shared user-level Skill directories and affect multiple future agent sessions. No privilege escalation beyond the invoking user's existing permissions is demonstrated by th ...[truncated 16 chars]
- Remediation
- ## Remediation Suggestions - Pin the installer package to an exact reviewed version, such as `npx package-name@x.y.z`. - Verify the package publisher and publish expected package integrity hashes. - Pin Git installations to a reviewed commit hash or signed release tag. - Verify downloaded content against a published SHA-256 digest or signed release. - Avoid global installation by default and document the exact files and permissions modified. - Clarify that “zero dependencies” applies to runtime code and not necessarily to the installation mechanism.