T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:80
- Finding
- Unpinned Third-Party Installer and Mutable Repository Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 80–86 **Vulnerability Type**: Supply-chain risk from unpinned external dependencies and mutable source repositories **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternative manual installation git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/kyc-checklist-gen ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation procedures rely on external components without binding them to immutable, previously audited versions: 1. `npx skills` can download and execute an npm package resolved at installation time. The command does not specify an exact package version or verify package integrity. 2. The repository installation method clones the repository's mutable default branch. It does not check out an audited commit, verify a release signature, or validate a cryptographic checksum. 3. The `-g` option causes the retrieved skill content to be installed globally within the relevant skills environment, increasing the scope over which modified content could be loaded. Consequently, the files installed by these commands may differ from the artifact reviewed during this audit. A compromised npm package, maintainer account, repository, or publishing pipeline could introduce malicious scripts or agent instructions after review. The audited runtime script itself does not fetch or execute remote payloads; this finding is limited to the documented installation supply chain. ### Attack Path 1. An attacker compromises the npm package, source repository, maintainer credentials, or release pipeline associated with the documented installation source. 2. The attacker publishes a modified CLI package or changes the repository's default branch to include malicious scripts or skill instructions. 3. A user follows the documented `npx` or `git clone` ...[truncated 1060 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the installer to an exact, audited version, for example by using an explicit npm package version rather than resolving the latest available release. 2. Pin repository-based installation to an immutable commit hash or a signed release tag. 3. Publish SHA-256 or stronger checksums for release artifacts and require verification before installation. 4. Sign release tags and packages, and document signature verification using a trusted maintainer key. 5. Avoid executing remotely resolved installer packages directly where practical. Download, inspect, and verify the installer before execution. 6. Install only the reviewed skill subdirectory or a signed release archive rather than cloning a mutable repository branch. 7. Avoid global installation unless it is operationally necessary. Prefer a dedicated, least-privileged user or isolated environment. 8. Add continuous supply-chain controls such as protected branches, mandatory review, multi-factor authentication, provenance attestations, and reproducible release artifacts. ]]>