T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:77
- Finding
- Unpinned Third-Party Installer and Mutable Remote Skill Source## Vulnerability Details **File Location**: `SKILL.md:77-81` **Vulnerability Type**: Supply-chain risk caused by unpinned third-party installation sources **Risk Level**: Medium ```bash npx skills add zhaoxinghua09-cell/agent-skills -g git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/lgd-crypto-guard ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process does not pin the npm CLI to an exact audited version. Consequently, `npx` may resolve, download, and execute a package version that differs from the version reviewed during this audit. The alternative installation procedure clones a mutable remote repository without specifying an audited commit, release tag, checksum, or cryptographic signature. Content obtained by future users can therefore differ from the audited project. Copying that content into an Agent skill directory may cause subsequently modified instructions or scripts to be trusted and invoked by the Agent. The `-g` option also requests global installation, increasing the potential scope of a compromised installer. No malicious behavior was found in the packaged `scripts/crypto_guard.py`; this finding concerns the unsafe installation and supply-chain process rather than the audited local implementation. ### Attack Path 1. An attacker compromises the referenced npm package, package publisher, GitHub account, or upstream repository. 2. The attacker publishes a malicious package version or modifies the repository's mutable default branch. 3. A user follows the documented `npx` or `git clone` installation instructions. 4. `npx` downloads and executes the current unpinned package, or Git retrieves modified Skill content that was not included in this audit. 5. In the npm path, attacker-controlled code can execute with the installing user's privileges. In the Git path, malicious scripts or instructions can become trusted after being copied into ...[truncated 866 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to an exact, reviewed version rather than relying on implicit current-version resolution: ```bash npx --yes skills@<audited-version> add zhaoxinghua09-cell/agent-skills ``` 2. Document and verify the expected npm package integrity hash and publisher identity. 3. Avoid global installation unless it is strictly required. Prefer a dedicated, least-privileged environment. 4. Pin repository installation to a reviewed commit: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach <audited-commit-sha> ``` 5. Publish SHA-256 checksums or signed release artifacts and require users to verify them before copying or executing files. 6. Install only the specific audited Skill artifact rather than cloning and trusting the entire repository. 7. Review all downloaded scripts and Skill instructions before placing them in an Agent-controlled directory. 8. Add automated release controls that ensure documentation pins the installer version and source commit corresponding to each audited release.