T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:88
- Finding
- Unpinned Package Execution and Installation from a Mutable Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 88–92 **Vulnerability Type**: Unpinned third-party package and mutable source repository **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g # Or manually: clone and copy this skill into the Agent skill directory git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/api-resilience ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation procedure invokes `npx skills` without specifying an exact package version or verifying package integrity. Depending on the local npm environment, `npx` may download and execute the current release of the named package. Consequently, the code executed during installation can differ from the version reviewed during this audit. The command also retrieves skill content from the default branch of a remote Git repository without pinning a reviewed commit hash or signed release. Both installation paths therefore depend on mutable upstream content. Compromise of the npm package, package publisher, GitHub account, or repository could cause users to execute or install content that was not present in the audited artifact. The `-g` option installs the skill globally for the relevant skill framework. This increases exposure because altered skill instructions could be available to future Agent sessions rather than remaining isolated to one project. ### Attack Path 1. An attacker compromises the npm package publisher, the source repository, or an authorized maintainer account. 2. The attacker publishes a modified package release or changes the repository's default branch. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx` downloads and executes the unpinned package, or `git clone` retrieves the modified default branch. 5. The modified content is copied into the user's global Agent skill directory. 6. Malicious installer behavior can execute ...[truncated 777 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI to an exact reviewed version, for example by using an explicit package version rather than an unversioned `npx` invocation. 2. Include npm integrity verification through a lockfile, published checksum, trusted registry policy, or signed provenance. 3. Pin repository installation to a reviewed commit hash or cryptographically signed release tag instead of cloning the mutable default branch. 4. Publish SHA-256 checksums or signatures for distributed skill files and document how users must verify them before installation. 5. Avoid global installation by default. Install into a project-scoped directory unless cross-project availability is explicitly required. 6. Instruct users to inspect downloaded scripts and skill instructions before activation. 7. Use a controlled installer that fails closed when package integrity, repository identity, commit signatures, or expected checksums cannot be verified. ]]>