T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:79
- Finding
- Unpinned npm Package Is Downloaded and Executed During Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:79` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the npm package named `skills` through `npx` without specifying a version or integrity constraint. If the package is not already available locally, `npx` can retrieve the current package release from the configured npm registry and execute its CLI code. Because package resolution is mutable, the code executed by this command is not fully represented by the audited project. A future compromised, malicious, or incompatible version of `skills`, a compromised publisher account, or a manipulated package registry could cause arbitrary code to run during installation. The `-g` argument also requests a global Skill installation. Although this does not itself grant operating-system administrator privileges, it can modify persistent files in the user's global Agent or Skill environment. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or the registry path used to resolve `skills`. 2. The attacker publishes a malicious version containing hostile CLI or installation behavior. 3. A user follows the documented command without specifying an audited version. 4. `npx` resolves and downloads the attacker-controlled package version. 5. The package executes with the privileges of the invoking user. 6. The malicious package can access user-readable data, modify user-writable files, or install altered Skill content into the global Skill environment. This path is conditional on compromise or malicious replacement of the external dependency; no malicious code was found in the project files themselves. ### Impact Assessment Successful exploitation could execute arbitrary code with the invoking user's privileges. The reachable scope includes fi ...[truncated 305 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a specific reviewed version, for example: ```bash npx --yes skills@<reviewed-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Record and verify the expected npm publisher, package provenance, and integrity information before execution. 3. Prefer a lockfile-controlled installation process where possible. 4. Avoid global installation unless it is required; install into a dedicated, least-privileged environment. 5. For stronger reproducibility, recommend cloning a pinned commit rather than the mutable default branch: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout <audited-commit-sha> ``` 6. Document the exact reviewed package version or repository commit in `SKILL.md` and update it only after security review. ]]>