T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:74
- Finding
- Unpinned Third-Party Installer Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, line 74 **Vulnerability Type**: Supply-chain risk caused by executing an unpinned third-party package **Risk Level**: Medium **Vulnerable Code**: ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The installation instructions invoke the `skills` npm package through `npx` without specifying an exact package version or integrity digest. If the package is not already available locally, `npx` may retrieve and immediately execute the package resolved by the npm registry. Because package resolution is mutable, the code executed by this command may differ from the code that was available when the Skill was audited. The global installation option, `-g`, also increases the potential scope of resulting modifications. This finding concerns the documented installation path; no malicious behavior was identified in the bundled Python script itself. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or another relevant package-distribution component. 2. The attacker publishes a malicious or altered version that can be resolved under the unpinned `skills` package name. 3. A user follows the documented installation instructions and runs the `npx` command. 4. `npx` downloads and executes the mutable package without verifying a project-specified version or integrity digest. 5. The package executes with the invoking user's privileges and may install attacker-controlled Skill content globally. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation command. The attacker could read or modify files accessible to that user, access available environment data, alter installed Skill content, or introduce malicious behavior into later agent sessions. The exact scope depends on the invoking use ...[truncated 168 chars]
- Remediation
- ## Remediation Suggestions - Pin the installer to an exact, reviewed package version rather than relying on the registry's current resolution: ```bash npx --yes skills@<reviewed-exact-version> add zhaoxinghua09-cell/agent-skills -g ``` - Verify the package publisher, provenance, and expected registry before recommending execution. - Use package-lock and integrity verification mechanisms where the installation workflow supports them. - Prefer a pinned source commit or release archive and publish its expected cryptographic checksum. - Avoid global installation by default. Install into a user-scoped or isolated directory with only the permissions required for the Skill. - Document a manual verification workflow so users can inspect downloaded code before executing it. - Consider distributing a reviewed local installer as part of the audited artifact instead of retrieving executable installer logic dynamically.