T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:79
- Finding
- Unpinned Third-Party Installer and Mutable Repository Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 79 **Vulnerability Type**: Unpinned third-party dependency and mutable supply-chain source **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command uses `npx` without pinning the `skills` package to a specific audited version. It also identifies the GitHub-hosted skill collection by repository name without pinning it to an immutable commit. When invoked, `npx` can retrieve and execute the package version currently resolved by the npm registry. The effective installer code may therefore differ from the code reviewed during this audit. Likewise, repository content resolved from a mutable default branch can change after publication. The `-g` option requests global installation, increasing the persistence and scope of any compromised content. This finding is limited to the documented installation workflow; the reviewed Python implementation itself does not retrieve remote payloads or execute subprocesses. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, the referenced GitHub repository, or an associated publishing credential. 2. The attacker publishes a malicious package version or modifies content on the repository's mutable default branch. 3. A user follows the documented command: ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` 4. `npx` resolves and executes the currently available installer rather than a previously audited version. 5. The installer retrieves and globally installs mutable repository content. 6. Malicious installer logic or skill content executes with the permissions of the invoking user and may remain available to agent environments through the global installation. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the user running the installation co ...[truncated 590 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI to an explicitly audited version: ```bash npx skills@<verified-version> add <source> ``` 2. Pin the repository source to an immutable, reviewed commit hash or signed release rather than a mutable branch: ```text zhaoxinghua09-cell/agent-skills@<verified-commit-sha> ``` 3. Publish and verify cryptographic checksums or signatures for the installer and skill artifact before installation. 4. Remove global installation as the default. Prefer a project-local or isolated installation with the minimum permissions required. 5. Use an npm lockfile or equivalent dependency-locking mechanism where supported, and enable integrity verification for downloaded packages. 6. Document the exact audited CLI version, repository commit, expected checksums, and verification commands. 7. Recommend installation from a non-elevated account and review downloaded content before execution. ]]>