T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:154
- Finding
- Unpinned Third-Party Package Execution in Installation Instructions## Vulnerability Details **File Location**: `SKILL.md`, line 154 **Vulnerability Type**: Supply-chain exposure through an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes `npx` without specifying an exact version or integrity digest for the `skills` package. Depending on the local environment, `npx` can retrieve the current package version from the configured package registry and execute its package code. Because the package reference is mutable, the code executed when a user follows these instructions may differ from the code available when this skill was audited. A compromised registry account, malicious package update, dependency compromise, or registry-configuration attack could therefore introduce attacker-controlled behavior. The `-g` option also requests installation into a global skill environment. Although this does not itself elevate operating-system privileges, it increases the persistence and scope of any malicious or unexpectedly modified skill content installed by the command. ### Attack Path 1. An attacker compromises the publisher account, package, transitive dependency, or registry source used to resolve the unpinned `skills` package. 2. The attacker publishes a malicious package version or causes dependency resolution to return attacker-controlled code. 3. A user follows the installation command in `SKILL.md`. 4. `npx` retrieves and executes the mutable package using the invoking user's permissions. 5. The malicious package can access resources available to that user and can install modified skill content into the global skill environment. 6. The installed content may subsequently affect other agent sessions that load or execute those globally installed skills. ### Impact Assessment Successful exploitation permits code execution with the privileges of the user running the document ...[truncated 455 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer to a reviewed, immutable version instead of relying on the latest registry release: ```bash npx skills@<audited-version> add zhaoxinghua09-cell/agent-skills ``` 2. Publish and verify a cryptographic integrity digest or signed release artifact before execution. 3. Document the expected package publisher, registry, version, and verification procedure. 4. Avoid global installation by default. Use a project-local or otherwise isolated skill directory unless global availability is explicitly required. 5. Review and lock transitive dependencies through a lockfile or equivalent reproducible dependency mechanism. 6. Prefer installation from a versioned release archive or commit digest whose contents match the audited package. 7. Recommend running installation with least privilege and never through `sudo` or an administrator account.