T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:80
- Finding
- Unpinned Third-Party Installation Chain<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:80-84` **Vulnerability Type**: Unpinned npm CLI and mutable Git repository installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/ai-usage-policy ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process relies on two third-party components whose exact contents are not pinned: 1. `npx skills` resolves and executes an unspecified version of the `skills` npm package. 2. `git clone` retrieves the external repository's mutable default branch without specifying a reviewed commit hash or immutable release tag. No checksum, signature, lock file, or commit verification is required before the retrieved content is installed. Consequently, the effective installer and skill contents may differ from the artifact covered by this audit. The global installation option (`-g`) can also expose all compatible agent sessions for the invoking user to compromised skill content. The local Python script reviewed in this artifact does not retrieve or execute remote payloads. The risk arises specifically from the installation instructions and their reliance on mutable external supply-chain sources. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, the source repository, or another component in the publishing chain. 2. The attacker publishes a malicious version of the unpinned `skills` package or modifies the repository's default branch. 3. A user follows the documented installation instructions. 4. `npx` resolves and executes the altered npm package, or `git clone` downloads the altered skill content. 5. The modified content is installed globally or copied into the user's agent skill directory. 6. When the installed skill is loaded or invoked, attacker-controlled instructions or scripts may execute with the p ...[truncated 728 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI to an explicitly reviewed version, for example: ```bash npx --yes skills@X.Y.Z add ... ``` 2. Pin repository installation to a reviewed commit hash rather than the mutable default branch: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <reviewed-commit-hash> ``` 3. Publish SHA-256 checksums or cryptographic signatures for release artifacts and require verification before installation. 4. Prefer immutable, signed release archives or verified tags over direct installation from a development branch. 5. Avoid global installation by default. Install into a restricted per-project skill directory unless global availability is explicitly required. 6. Document the expected npm package version, repository commit, and artifact digest together so users can verify that they are installing the audited release. 7. Review fetched skill instructions and executable scripts before loading or invoking them, especially when their content differs from the audited artifact. ]]>