T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:79
- Finding
- Unpinned Third-Party Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:79` **Vulnerability Type**: Unpinned and unverified third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the `skills` package through `npx` without specifying a package version or integrity hash. If the package is not already installed locally, `npx` may retrieve and execute its currently published version. The retrieved package is outside the reviewed artifact, and its implementation can change after this skill has been audited. Package initialization code, lifecycle behavior, or CLI logic therefore executes without being covered by this audit. The global installation option also increases the potential scope of filesystem changes. Exploitation requires compromise or malicious replacement of the referenced package, its publisher account, or another relevant part of the package distribution chain. ### Attack Path 1. An attacker compromises the package publisher account, package distribution channel, or a mutable upstream release. 2. The attacker publishes a malicious version of the unpinned `skills` package. 3. A user follows the installation command in `SKILL.md`. 4. `npx` retrieves the malicious current package version. 5. The package executes with the privileges of the invoking user. 6. The malicious package can access or modify resources available to that user, including files, environment variables, and user-level configuration. ### Impact Assessment Successful exploitation could result in arbitrary code execution with the invoking user's privileges. The affected scope could include user-owned files, accessible credentials in the environment, development configuration, and globally installed user-level components. Administrative privileges are not obtained inherently, but impact would increase if the user run ...[truncated 37 chars]
- Remediation
- ## Remediation Suggestions - Pin the package to a specifically audited version rather than executing the latest available release. - Verify package provenance, publisher identity, and integrity before execution. - Use lockfiles or cryptographic integrity hashes where the installation mechanism supports them. - Avoid global installation unless it is necessary for the documented functionality. - Prefer an installation process that retrieves a reviewed source revision identified by an immutable commit hash. - Document the expected package name, version, checksum, and trusted registry. - Recommend execution from a non-privileged account and explicitly warn users not to run the command with administrative privileges.