T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:77
- Finding
- Unpinned Package Execution in the Documented Installation Command## Vulnerability Details **File Location**: `SKILL.md`, line 77 **Vulnerability Type**: Supply-chain exposure through an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented one-command installation procedure invokes the unversioned `skills` npm package through `npx`. If the package is unavailable in the local cache, `npx` may retrieve and execute the package currently published under that name. Neither an exact package version nor an integrity hash is specified. Consequently, the code executed by this command can differ from the code that was reviewed. A compromised package publisher, registry account, distribution channel, or later malicious release could turn this installation command into a remote code-execution vector. The `-g` option also requests a global installation, unnecessarily expanding the scope of changes. This finding concerns the documented installation path. The bundled Python implementation itself uses only standard-library modules and contains no observed remote retrieval or third-party runtime dependency. ### Attack Path 1. An attacker compromises the publisher account or distribution process for the npm package resolved as `skills`, or causes a malicious version to be selected through a supply-chain attack. 2. The attacker publishes a modified package containing malicious installation or runtime logic. 3. A user follows the documented command in `SKILL.md`. 4. `npx` resolves and downloads the mutable package version without a project-specified version or integrity constraint. 5. The downloaded package executes with the privileges of the user running the command. 6. The malicious process can modify files and install altered skill content within that user's accessible scope. If the command is run from an elevated shell, the resulting impact may extend to privileged or system-wide locations. ### Impact Assessment ...[truncated 460 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the package to a specifically reviewed version rather than relying on the latest registry release: ```bash npx --yes skills@<audited-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Verify the package's integrity using the package manager lockfile or a documented registry integrity digest. Revalidate the digest whenever the approved version changes. 3. Avoid global installation unless it is operationally necessary. Prefer a user-scoped or project-local destination that follows least-privilege principles. 4. Prefer a repository checkout pinned to a reviewed commit rather than a mutable branch: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout <reviewed-commit-sha> ``` 5. Document how users can verify the repository commit, release signature, or checksum before copying and executing skill files. 6. Advise users not to run the installation command from an elevated or administrative shell. 7. In release automation, generate and publish checksums or signed provenance for the exact package contents reviewed by maintainers.