T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:81
- Finding
- Unpinned Third-Party Installation Commands Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:81-85` **Vulnerability Type**: Unpinned executable package and mutable repository installation **Risk Level**: Medium ### Vulnerable Code ```bash # One-click installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/disk-scan ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation procedure executes the `skills` npm package through `npx` without specifying an exact package version or integrity value. Depending on the local npm configuration and cache state, `npx` can download and execute the package version currently resolved by the registry. Consequently, the executable installer used in the future may differ from the one reviewed during this audit. The alternative procedure clones the default branch of a remote Git repository without pinning a reviewed commit or tag. Default branches are mutable, so the files copied into the agent's skill directory may change after this package has been audited. Neither procedure performs checksum, signature, lockfile, or commit verification. Although no malicious content was identified in the bundled `scripts/disk_scan.py`, the documented installation paths establish an avoidable dependency on mutable third-party content. ### Attack Path 1. An attacker compromises the relevant npm package, npm publisher account, source repository, or repository maintainer account. 2. The attacker publishes a modified package release or pushes malicious content to the repository's default branch. 3. A user follows the installation instructions in `SKILL.md`. 4. The `npx` command downloads and executes the newly resolved package, or `git clone` obtains the modified default branch. 5. The resulting content is globally installed or copied into the user's agen ...[truncated 1009 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an exact reviewed version: ```bash npx --yes skills@<exact-version> add zhaoxinghua09-cell/agent-skills@<immutable-reference> -g ``` 2. Confirm that the CLI supports immutable skill references before recommending this syntax. If it does not, download and verify the skill separately rather than relying on mutable resolution. 3. Pin Git installation to a reviewed commit: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <reviewed-full-commit-hash> ``` 4. Publish SHA-256 checksums or signed release artifacts and require verification before copying or loading the skill. 5. Prefer signed tags or releases, while still documenting the expected immutable commit hash because tags can be moved. 6. Avoid global installation by default. Install into a scoped user directory only after displaying the exact files and permissions that will be added. 7. Document the trust boundary clearly: installation commands retrieve content from external services, and users should verify the publisher, package version, commit, and artifact digest. 8. In automated environments, use a lockfile, an approved internal registry or mirror, and a policy that rejects packages or source revisions not present in an allowlist.