T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:77
- Finding
- Unpinned Third-Party CLI Execution and Overbroad Global Installation## Vulnerability Details **File Location**: `SKILL.md`, line 77 **Vulnerability Type**: Supply-chain risk from an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The installation instructions invoke the third-party `skills` CLI through `npx` without specifying an immutable package version or integrity hash. Depending on the local npm configuration and cache state, `npx` may download and execute the package version currently available from the configured registry. The executed code can therefore change after this Skill has been audited. The command also requests global installation with `-g` and references the complete remote `agent-skills` repository rather than restricting installation to the audited `lgd-fin-guard` artifact. This expands the trust boundary to include the dynamically resolved CLI package, the current contents of the remote repository, and other Skills that were not part of this audit. No malicious behavior was found in the packaged `scripts/fin_guard.py`; the risk arises from the documented installation path and its mutable external dependencies. ### Attack Path 1. An attacker compromises the package resolved as `skills`, its publishing account, the configured npm registry, or the referenced repository. 2. The attacker publishes malicious CLI code or inserts malicious content into the repository after this artifact was reviewed. 3. A user follows the documented command in `SKILL.md`. 4. `npx` downloads and executes the dynamically resolved CLI package. 5. The CLI retrieves the repository's current contents and installs them globally. 6. Malicious package lifecycle behavior, CLI logic, or repository content executes or becomes available in the user's global agent environment. ### Impact Assessment Successful exploitation could execute code with the privileges of the user running `npx`. Depending on those privileges and the be ...[truncated 593 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an explicitly reviewed version rather than allowing dynamic resolution: ```bash npx --yes skills@<reviewed-version> ... ``` 2. Lock the source repository to an immutable commit SHA or signed release tag instead of installing from the mutable default branch. 3. Verify downloaded artifacts using a published cryptographic checksum or signature before execution or installation. 4. Avoid global installation where possible. Install into a dedicated, least-privileged Skill directory or isolated environment. 5. Install only the `lgd-fin-guard` Skill rather than the entire `agent-skills` repository. 6. Disable or carefully review package lifecycle scripts and inspect the exact resolved package before first use. 7. Document the expected CLI package name, version, source, digest, repository commit, and resulting installed files so users can independently verify the installation. 8. As a safer alternative, provide a release archive containing only this Skill, publish its checksum, and instruct users to verify and extract it without executing a remotely resolved installer.