T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:85
- Finding
- Unpinned Third-Party Installer Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md:85` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented one-click installation command uses `npx` without specifying an exact version of the `skills` package. It also identifies the skill repository using a mutable repository name rather than a verified commit hash or immutable release artifact. When a user follows this instruction, `npx` may retrieve and execute the package version currently resolved by the package registry. Consequently, the installer code executed at installation time may differ from the code reviewed during this audit. The global installation option (`-g`) increases the affected scope by installing the retrieved content into a shared user-level or system-level skill environment. Exploitation depends on a malicious or compromised upstream package, package registry account, repository, or installation path. The audited local Python script itself does not retrieve or execute remote code. ### Attack Path 1. An attacker compromises the publishing account, package, repository, or another mutable component resolved by the installation command. 2. The attacker publishes a modified installer or malicious skill content. 3. A user follows the documented `npx skills add ... -g` instruction. 4. `npx` resolves and executes the current, unpinned installer package. 5. The compromised installer runs with the invoking user's privileges or globally installs altered skill content. 6. The malicious content can affect subsequent agent sessions in environments that load the globally installed skill. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation command. Potential effects include modification of u ...[truncated 522 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` CLI to an exact, reviewed package version rather than allowing `npx` to resolve the latest available release. 2. Pin the requested repository content to a verified commit hash or immutable signed release. 3. Publish cryptographic checksums or signatures for installation artifacts and verify them before installation. 4. Avoid global installation unless it is strictly necessary; prefer a dedicated, least-privileged environment. 5. Use a package lockfile or equivalent integrity metadata wherever the installation workflow supports it. 6. Document the exact package source, version, repository revision, and expected checksum used for each audited release. 7. Recommend inspecting downloaded content before enabling the skill, especially when installation traverses mutable third-party infrastructure.