T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:84
- Finding
- Unpinned Remote Installation Inputs Create a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 84–88 **Vulnerability Type**: Unpinned npm CLI package and mutable Git repository **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy this Skill into the Agent's Skill directory git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/evidence-chain-builder ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation procedure invokes `npx skills` without an exact package version or integrity verification. If the package is not already available locally, `npx` may retrieve and execute the current registry release, making installation behavior dependent on mutable third-party content that was not part of this audit. The alternative installation procedure clones the repository's default branch without pinning it to the reviewed commit, a signed release, or a verified checksum. Consequently, the installed files may differ from the audited artifact. This is a supply-chain weakness rather than evidence that the current package contains a malicious payload. Exploitation requires compromise or malicious alteration of the relevant package, package publisher, source repository, or distribution infrastructure. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the source repository, or an associated distribution channel. 2. The attacker publishes a modified CLI package or commits altered Skill content to the mutable upstream branch. 3. A user follows one of the documented installation commands. 4. In the `npx` path, the changed package can execute code with the installing user's privileges. 5. In the Git path, changed scripts or instructions are copied into the persistent Agent Skill directory. 6. The altered Skill may execute when invoked or influence later Agent sessions after being loaded. # ...[truncated 660 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to a reviewed exact version: ```bash npx --yes skills@<exact-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Publish and verify the package's cryptographic integrity before execution. Preserve the package lockfile and registry integrity metadata where supported. 3. Pin repository installation to a reviewed commit hash rather than the mutable default branch: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <reviewed-commit-hash> ``` 4. Prefer signed release tags and verify their signatures before copying files. 5. Publish SHA-256 checksums or signed attestations for release artifacts and require verification during installation. 6. Avoid global installation unless it is operationally necessary. 7. Audit the exact installer package version and repository revision independently before recommending them. 8. Run installation with least privilege in an isolated environment where practical.