T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:81
- Finding
- Unpinned Third-Party Installer and Mutable Remote Skill Source## Vulnerability Details **File Location**: `SKILL.md`, lines 81–87 **Vulnerability Type**: Supply-chain exposure through unpinned executable tooling and mutable remote content **Risk Level**: Medium ```bash # One-click installation (skills CLI) npx skills add zhaoxinghua09-cell/agent-skills -g # Or manually: clone and copy this skill into the Agent skill directory git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/contract-clause-check ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process invokes the `skills` npm CLI through `npx` without specifying an exact package version or verifying package integrity. Depending on the local npm configuration and cache state, `npx` can retrieve and execute the package currently published under that name. Consequently, the code executed during installation is not necessarily the code reviewed in this artifact. The manual installation alternative clones a mutable repository default branch rather than a specific commit or signed release. It performs no checksum, signature, or provenance verification before copying repository content into an agent's skill directory. The `-g` option further installs the retrieved skill into a global environment. Although the audited local Python scanner contains no malicious behavior, these instructions create a supply-chain boundary through which future or compromised remote content could differ from the reviewed artifact. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the referenced GitHub repository, or another relevant distribution component. 2. The attacker publishes a modified installer or adds malicious instructions or scripts to the mutable repository content. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx` executes the unpinned package, or `git clone` retrieves the altered default branch, without integrity or sign ...[truncated 934 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to a reviewed exact version, for example by using `npx --yes skills@<exact-version>`, and lock its transitive dependencies where supported. 2. Pin repository installation instructions to an immutable commit hash or versioned release tag rather than the default branch. 3. Publish SHA-256 checksums or cryptographic signatures for release artifacts and require verification before installation. 4. Prefer a package manager mode that enforces lockfiles and integrity metadata instead of executing an implicitly resolved package. 5. Avoid global installation by default. Install into a project-scoped, isolated skill directory with least-privilege permissions. 6. Require users or automation to inspect the resolved package contents, scripts, and skill instructions before activation. 7. Protect publisher and repository accounts with multi-factor authentication, restricted release permissions, branch protection, and auditable release workflows. 8. Document the exact trusted version, commit, checksum, and expected file inventory so users can verify that installed content matches the audited artifact.