T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:83
- Finding
- Unpinned Third-Party Installer and Mutable Remote Skill Source## Vulnerability Details **File Location**: `SKILL.md`, lines 83–87 **Vulnerability Type**: Supply-chain risk caused by unpinned external components **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/contract-interact-checklist ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process invokes `npx skills` without specifying an exact package version or integrity hash. This allows the package resolved by npm at installation time to differ from the version that was reviewed. The alternative installation procedure clones a mutable default branch rather than a pinned commit or signed release. It then copies the downloaded content into the user's Agent skill directory without verifying its checksum, signature, or provenance. Although the audited local Python script contains no remote retrieval or code-execution behavior, these installation instructions create a supply-chain boundary outside the reviewed artifact. A compromised or subsequently modified npm package or repository could deliver different code or Agent instructions. ### Attack Path 1. An attacker compromises the npm package resolved as `skills`, its publishing account, the referenced repository, or another relevant distribution component. 2. The attacker publishes malicious installer behavior or modifies the repository's default branch. 3. A user follows the documented `npx` or `git clone` installation procedure. 4. The installation resolves and downloads the attacker-controlled version because no immutable version, commit, checksum, or signature is required. 5. The downloaded skill is globally installed or copied into the Agent's skill directory. 6. Malicious scripts or instructions may execute when invoked or influence later Agent se ...[truncated 726 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm installer to a reviewed exact version, rather than invoking an unversioned package: ```bash npx --yes skills@X.Y.Z add zhaoxinghua09-cell/agent-skills -g ``` 2. Pin repository installation to a reviewed immutable commit or signed release tag: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach REVIEWED_COMMIT_SHA ``` 3. Publish a cryptographic checksum or signed provenance statement for the approved artifact and require verification before copying it into an Agent skill directory. 4. Avoid global installation by default. Prefer a scoped installation location with the minimum permissions required. 5. Instruct users to inspect downloaded scripts and skill instructions before activation. 6. Use protected release tags, signed commits or releases, multi-factor authentication for publisher accounts, and narrowly scoped publishing credentials. 7. Ensure installation fails closed if version, signature, checksum, or provenance verification does not succeed.