T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:76
- Finding
- Unpinned Third-Party Package Execution in Installation Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 76-83 **Vulnerability Type**: Unpinned and mutable supply-chain dependencies **Risk Level**: Medium ```bash ## Installation and usage matrix ```bash # One-click installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/ai-vendor-checklist ~/.workbuddy/skills/ ``` ``` ### Technical Analysis The recommended installation process invokes `npx skills` without specifying an exact npm package version or verifying an integrity digest. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the currently resolved release of the `skills` package. This means the code executed during installation may differ from the version present when this skill was audited. The alternative procedure also clones the default state of a remote repository without pinning a reviewed commit or signed release. Subsequent upstream changes can therefore alter the content installed into the user's agent skill directory. This is a supply-chain weakness rather than evidence that the current package or repository is malicious. The bundled Python script itself uses only standard-library modules and contains no observed remote retrieval or malicious execution behavior. ### Attack Path 1. An attacker compromises the npm package publisher account, upstream package, distribution channel, or referenced Git repository. 2. The attacker publishes a modified release or changes the repository's default branch. 3. A user follows the documented installation instructions after the compromise. 4. The unpinned `npx` command resolves and executes the modified package, or the unpinned Git command retrieves altered skill content. 5. The malicious installer runs with the invoking user's privileges, or attacke ...[truncated 884 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI package to an exact reviewed version instead of resolving the latest available release: ```bash npx --yes skills@<reviewed-exact-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Commit and distribute a lockfile where applicable, and verify the package integrity value against a trusted, separately published digest. 3. Pin the repository checkout to a reviewed commit or signed release: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <reviewed-commit-hash> ``` 4. Verify the commit signature or a published cryptographic checksum before copying any files. 5. Prefer a download-and-verify workflow that does not execute package code merely to install the skill. 6. Document that installation must be performed as an unprivileged user and must not use `sudo` or an administrator shell. 7. Review the exact downloaded scripts and skill instructions before placing them in an agent-controlled directory.