T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:81
- Finding
- Unpinned Third-Party Installation Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:81-85` **Vulnerability Type**: Unpinned third-party dependency and mutable source installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g # Or manually clone and copy the skill git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/csv-slice ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation procedures retrieve third-party components without pinning them to immutable, previously audited versions: - The `npx` command does not specify a version of the `skills` package. - The Git command clones the repository's current default branch rather than a specific commit or signed release. - The retrieved content is copied into a persistent Agent skill directory. - No checksum, signature, or integrity verification is required before installation. Consequently, the content installed by these commands can differ from the artifact reviewed during this audit. If the npm package, source repository, maintainer account, release process, or upstream distribution channel is compromised, an attacker could replace the expected content with malicious scripts or Agent instructions. The audited `scripts/csv_slice.py` file itself does not retrieve or execute remote payloads. The risk arises from the mutable installation workflow documented in `SKILL.md`. ### Attack Path 1. An attacker compromises the relevant npm package, GitHub repository, maintainer credentials, or upstream release process. 2. The attacker publishes a modified CLI package or commits malicious content to the repository's default branch. 3. A user follows the documented installation command without specifying an immutable version or commit. 4. The user's system retrieves the attacker-controlled version. 5. The retrieved skill is installed globally or copied into `~/.workbuddy/skills/`. 6. When the Agent later loads or invokes the ...[truncated 788 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI to an explicitly reviewed version: ```bash npx skills@<reviewed-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Pin Git installation instructions to an immutable commit: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <reviewed-commit-sha> ``` 3. Publish SHA-256 checksums or signed release manifests for the exact files being installed, and require verification before copying them into an Agent skill directory. 4. Prefer signed tags or releases and document how users can verify the maintainer's signature and expected commit identity. 5. Avoid global installation by default. Install only the required skill into a scoped directory after reviewing its instructions and executable files. 6. Ensure automated release pipelines fail when package versions, repository commits, or integrity metadata are missing. ]]>