T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:82
- Finding
- Unpinned Third-Party Package Execution During Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82` **Vulnerability Type**: Unpinned third-party package execution and supply-chain exposure **Risk Level**: Medium ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The installation instructions invoke the third-party `skills` package through `npx` without specifying an exact package version or verifying an integrity digest. Depending on the local npm configuration and cache state, `npx` may download and immediately execute a mutable package from the npm registry. The effective installer code is not included in the audited artifact. Consequently, its behavior cannot be reviewed alongside this Skill and may change independently after publication. The command also requests a global Skill installation through `-g`, increasing the persistence and scope of any content installed by the external tool. This external installer is unnecessary for the Skill's core functionality because the audited package already includes a zero-dependency Python script that can run locally. The installation procedure therefore introduces supply-chain execution privileges beyond the minimum needed to perform health-claim screening. ### Attack Path 1. A user follows the installation command in `SKILL.md`. 2. `npx` resolves the unpinned `skills` package using the configured npm registry. 3. If the package, package maintainer account, registry resolution path, or dependency chain has been compromised, `npx` downloads attacker-controlled code. 4. The downloaded package executes with the permissions of the invoking user. 5. The malicious installer may read or modify user-accessible files, execute additional processes, access available environment credentials, or install altered Agent Skill instructions globally. 6. Globally installed malicious Skill content may subsequently affect other Agent sessions that load it. This path depends on compromise or malicious replacement of the external ...[truncated 838 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `npx` installation path when the bundled Python script is sufficient, and document direct local execution instead: ```bash python scripts/health_claim_guard.py --help ``` 2. If the external installer remains necessary, pin the package to an exact reviewed version rather than resolving the latest mutable release: ```bash npx --yes skills@EXACT_REVIEWED_VERSION add zhaoxinghua09-cell/agent-skills -g ``` 3. Prefer installing the package through a committed npm lockfile and then invoking its local binary. Verify the lockfile's registry source and integrity metadata during release review. 4. Pin repository content to a reviewed commit SHA rather than a mutable branch, tag, or default branch. 5. Install only the `health-claim-guard` Skill rather than repository-wide content. 6. Avoid global installation by default. Use a project-local or isolated Skill directory and clearly document every file and directory the installer modifies. 7. Publish and verify cryptographic checksums or signed release artifacts for both the installer and Skill package. 8. Treat the external installer and fetched repository as separate audit targets before recommending their execution. ]]>