T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:79
- Finding
- Unpinned Third-Party Installer Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, line 79 **Vulnerability Type**: Unpinned third-party installer execution **Risk Level**: Medium **Vulnerable code snippet**: ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternative manual installation git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/citation-coverage-check ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying an exact package version or validating its integrity. Consequently, the package resolved when a user runs the command may differ from the package available when this skill was audited. The command also installs skill content from the mutable `zhaoxinghua09-cell/agent-skills` repository reference rather than from a reviewed commit hash or cryptographically verified release artifact. The manual installation alternative similarly clones the repository's current default branch without pinning a commit. This does not establish that the current npm package or repository is malicious. However, it creates a supply-chain trust boundary in which a compromised package, publisher account, repository, or future upstream update could introduce code or instructions that were not part of the reviewed artifact. Because `npx` may download and execute package-provided installer logic, compromise can affect the invoking user's environment before the installed content is independently reviewed. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the upstream repository, or another relevant distribution component. 2. The attacker publishes a modified package version or changes the mutable repository content. 3. A user follows the installation instructions and runs `npx skills add zhaoxinghua09-cell/agent-skills -g`. 4. `npx` resol ...[truncated 1160 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer package to an explicitly reviewed version, for example `npx skills@<reviewed-version> ...`. 2. Require installation from an immutable repository commit or signed release tag rather than a mutable default branch. 3. Publish and verify cryptographic checksums or signatures for downloaded release artifacts before installation. 4. Prefer a locally reviewed installer dependency managed through a lockfile instead of resolving executable packages dynamically. 5. Avoid global installation by default. Install into a dedicated, least-privileged skill directory and clearly document the files that will be created or modified. 6. Add a review step that displays the exact resolved package version, repository commit, and files to be installed before executing installer hooks or activating skills. 7. Document that users should not run the installation command with administrator or root privileges.