T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:81
- Finding
- Unpinned Third-Party Package and Repository Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 81-86 **Vulnerability Type**: Unpinned and mutable third-party installation sources **Risk Level**: Medium ```bash # One-command installation (skills CLI) npx skills add zhaoxinghua09-cell/agent-skills -g # Or manually: clone and copy this skill into the Agent skill directory git clone https://github.com/zhaoxinghua09-cell/agent-skills.git ``` ### Technical Analysis The documented one-command installation invokes `npx skills` without specifying an exact package version or integrity digest. Depending on the local npm configuration and cache state, `npx` can download and execute the currently resolved version of the package. The executed dependency is not included in this audited artifact, so its behavior cannot be verified by this review. The alternative installation procedure clones a mutable repository reference without specifying a reviewed commit hash or signed release. Consequently, the repository content installed by a user can differ from the content that was audited. This creates a supply-chain trust gap: compromise of the package registry account, npm package, source repository, maintainer account, or upstream release process could cause users to retrieve altered code or Skill instructions. ### Attack Path 1. An attacker compromises or gains publishing control over the package resolved by `npx skills`, or modifies the referenced source repository. 2. The attacker publishes a malicious package version or commits altered scripts and Skill instructions to the repository's default branch. 3. A user follows the installation commands in `SKILL.md`. 4. In the `npx` path, the mutable package is retrieved and its code can execute with the invoking user's privileges. 5. In the Git path, mutable repository content is copied into the user's Agent skill directory and may subsequently be loaded or executed as a trusted Skill. 6. The malicious dependency or Skill can access resources available to th ...[truncated 796 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `npx` package to an exact reviewed version rather than resolving the latest available release: ```bash npx skills@<reviewed-version> add zhaoxinghua09-cell/agent-skills@<reviewed-version> -g ``` 2. Document the expected npm package integrity digest and provide a verification procedure before execution. 3. Prefer a locally installed, lockfile-controlled CLI over dynamically downloading and executing a package through `npx`. 4. Pin the Git installation to a specific reviewed commit: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <reviewed-commit-sha> ``` 5. Publish signed tags or release artifacts and require users to verify signatures or checksums before installation. 6. Avoid global installation by default. Install into a dedicated, least-privileged Agent directory or isolated environment. 7. Ensure updates undergo the same security review and require explicit user approval before changing the pinned version or commit.