T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:75
- Finding
- Unpinned npm Package Execution in Installation Instructions## Vulnerability Details **File Location**: `SKILL.md:75` **Vulnerability Type**: Supply-chain exposure through unpinned package execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The installation instructions invoke the `skills` npm package through `npx` without specifying an exact package version or integrity value. If the package is not already installed locally, `npx` may retrieve and execute it from the configured npm registry. Because package resolution is not pinned to an audited release, the code executed by this command can change after the skill itself has been reviewed. A compromised maintainer account, registry package, dependency, or unexpectedly changed future release could therefore introduce arbitrary installation-time behavior. The repository identifier passed to the command does not mitigate the risk associated with executing the unpinned `skills` package itself. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or one of its install-time dependencies. 2. The attacker publishes a malicious version under the package name resolved by `npx skills`. 3. A user follows the documented installation command. 4. `npx` downloads and runs the currently resolved package version. 5. Malicious package code executes with the privileges of the invoking user before or during skill installation. ### Impact Assessment Successful exploitation could execute arbitrary code with the invoking user's privileges. Depending on those privileges and the malicious package behavior, the affected scope could include user files, environment variables, credentials available to the process, development configuration, and globally installed skill files. The command does not itself request administrative privileges, so impact is normally limited to the invoking account unless it is run from an elevated shell.
- Remediation
- ## Remediation Suggestions - Pin the installation CLI to a specifically reviewed version instead of resolving the latest available release. - Where supported, verify package integrity using a lockfile, checksum, signature, or package-manager integrity metadata. - Prefer a two-step process that installs a pinned CLI version and then invokes it, making the executed dependency explicit. - Alternatively, document installation from the source repository at a pinned commit hash and instruct users to verify the commit before installation. - Avoid recommending execution from an elevated shell. - Periodically review and update the pinned version through a controlled dependency-update process.