T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:90
- Finding
- Unpinned Third-Party Package Execution and Mutable Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 90-96 **Vulnerability Type**: Unpinned executable dependency and mutable supply-chain source **Risk Level**: Medium ### Vulnerable Code ```bash # One-click installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/bias-auditor ~/.workbuddy/skills/ ``` ### Technical Analysis The documented one-click installation invokes the unversioned `skills` npm package through `npx`. When the package is not already available locally, `npx` can download and execute the package resolved from the configured npm registry. Because no exact package version or integrity digest is specified, the code executed at installation time can differ from the version reviewed during this audit. The alternative installation procedure clones the default branch of a remote repository without pinning a commit or verifying a signature or checksum. The copied skill may therefore differ from the audited artifact if the upstream branch changes or is compromised. Although cloning and copying do not directly execute the repository's scripts, installing modified skill instructions can affect later agent sessions when the skill is loaded. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the configured registry, or the upstream Git repository. 2. The attacker publishes a modified CLI release or changes the repository's default branch. 3. A user follows the installation instructions in `SKILL.md`. 4. In the `npx` path, the mutable package is downloaded and executed with the invoking user's privileges. 5. In the Git path, attacker-controlled skill files are copied into the user's agent skill directory. 6. The malicious installer can act immediately, while a malicious copied skill can influence subseq ...[truncated 768 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an audited exact version, for example `npx --yes skills@X.Y.Z`, after confirming the correct trusted package identity. 2. Use npm lockfiles and registry integrity metadata where the installation workflow permits them. 3. Pin repository installation to a specific reviewed commit or signed release tag rather than the mutable default branch. 4. Publish a SHA-256 checksum or cryptographic signature for release archives and require verification before installation. 5. Prefer downloading a signed release archive over executing a package dynamically through `npx`. 6. Avoid global installation unless it is necessary; use a scoped, user-local skill directory and least-privilege permissions. 7. Document the expected package publisher, repository commit, checksum, and verification procedure so users can detect source substitution. 8. Repeat the security review whenever the pinned package version or repository commit changes.