T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:67
- Finding
- Unpinned Package Execution and Mutable Remote Repository Installation## Vulnerability Details **File Location**: `SKILL.md:67-73` **Vulnerability Type**: Unpinned third-party package execution and mutable remote dependency retrieval **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/github-api-push-workaround ~/.workbuddy/skills/ ``` ### Technical Analysis The installation instructions execute `skills` through `npx` without specifying an exact npm package version or integrity value. Depending on the local npm environment, `npx` may download and execute the package version currently resolved from the configured registry. The effective executable is therefore not fixed to the content reviewed in this audit. The alternative procedure clones the mutable default branch of a remote GitHub repository rather than a reviewed commit hash or signed release. It also retrieves the entire `agent-skills` repository, even though this audit covered only the four files in the submitted artifact. The resulting installation may consequently differ from the audited package. The `-g` option requests global skill installation. This broadens the effect of compromised content because installed skills may remain available to multiple future agent sessions. The `git clone` command alone does not execute repository code, but later loading or invoking copied skill content can expose the agent to any instructions or scripts introduced into the mutable repository. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the configured package registry, or the referenced GitHub repository. 2. The attacker publishes or commits modified package code, skill instructions, or executable scripts. 3. A user follows the documented installation procedure. 4. ...[truncated 1171 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to an exact reviewed version, for example `npx --yes skills@X.Y.Z ...`, and document the expected package integrity hash. 2. Pin the repository to a reviewed commit hash rather than cloning and using the mutable default branch. 3. Prefer a signed release archive with a published SHA-256 checksum or another verifiable integrity mechanism. 4. Install only the required skill directory instead of retrieving and installing the complete remote skill collection. 5. Avoid global installation by default. Use a project-scoped or isolated skill directory and require explicit user approval before broader installation. 6. Review the resolved npm package and repository contents before execution or activation, including lifecycle scripts and any skill scripts. 7. Keep the packaged artifact self-contained so installation does not silently expand the trusted codebase beyond the files that were audited.