T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:76
- Finding
- Unpinned npm Package Execution in Installation Instructions## Vulnerability Details **File Location**: `SKILL.md`, line 76 **Vulnerability Type**: Supply-chain risk caused by executing an unpinned third-party package **Risk Level**: Medium ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the npm package named `skills` through `npx` without specifying an exact version, integrity hash, lockfile, registry, or expected publisher identity. If the package is absent from the local npm cache, `npx` may download the version currently resolved by the configured registry and execute its package lifecycle or CLI code. As a result, the executable installation path is not fully represented by the audited project. Its behavior can change after this Skill has been reviewed. Registry compromise, maintainer-account compromise, package replacement, or an unexpectedly unsafe future release could cause users following the documentation to execute attacker-controlled code. The bundled Python script does not exhibit this behavior; the issue is confined to the documented `npx` installation path. ### Attack Path 1. An attacker compromises the npm package, publisher account, registry resolution path, or a future release resolved under the package name `skills`. 2. A user follows the one-command installation instruction in `SKILL.md`. 3. `npx` resolves and downloads the attacker-controlled or compromised package version. 4. npm executes the package's CLI and potentially its lifecycle scripts with the installing user's privileges. 5. The malicious package can modify files accessible to that user, including Agent skill directories targeted by the global installation, and may execute unrelated system actions. ### Impact Assessment Successful exploitation permits code execution with the privileges of the user running the installation command. The accessible scope may include the ...[truncated 409 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer to an exact, reviewed package version rather than allowing mutable latest-version resolution. 2. Document the expected npm registry, package publisher, and package identity so users can verify provenance. 3. Publish and verify an integrity digest or signed provenance record for the approved installer artifact. 4. Disable or avoid npm lifecycle scripts where feasible, and document a safer installation path that does not execute remotely resolved code. 5. Prefer downloading a versioned source archive or commit, verifying its checksum or signature, reviewing it locally, and then copying the Skill into the intended directory. 6. Re-audit the exact installer package and version before recommending it as the primary installation method. 7. Correct the version inconsistency between `SKILL.md` (`1.1.0`) and `manifest.json` (`1.0.0`) to improve artifact provenance and release traceability.