T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:86
- Finding
- Unpinned Remote Skill Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 86–90 **Vulnerability Type**: Unpinned dependency and mutable remote source **Risk Level**: Medium ### Vulnerable Code ```bash # One-command installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/mcp-security-scan ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process retrieves software from mutable remote sources without pinning an immutable package version, Git commit, or verified release artifact. The `npx` command does not identify a fixed version of the `skills` CLI. Depending on the local npm configuration and cache state, it can retrieve and execute a newer package version than the one reviewed. The skill source is also identified only by a repository name rather than a commit digest. The alternative `git clone` process checks out the repository's current default branch. Its contents can change after this artifact has been audited. No checksum, cryptographic signature, commit identifier, or release verification is required before the files are copied into the Agent's skill directory. This issue does not establish that the current upstream package or repository is malicious. It creates a supply-chain path through which future upstream compromise or unauthorized modification could replace the reviewed content. ### Attack Path 1. An attacker compromises the npm package or account used by the unpinned `npx` command, or gains control of the referenced Git repository. 2. The attacker publishes a modified CLI package or changes the repository's default branch to include malicious skill instructions or scripts. 3. A user follows the installation commands in `SKILL.md`. 4. The mutable remote content is downloaded without integrity or provenance verification. 5. With the `npx` path, the m ...[truncated 895 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` CLI to a reviewed version: ```bash npx skills@<reviewed-version> add zhaoxinghua09-cell/agent-skills@<immutable-reference> -g ``` 2. Pin manual installation to a full Git commit hash: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout <full-reviewed-commit-hash> ``` 3. Publish a SHA-256 checksum or cryptographic signature for the reviewed release and require verification before installation. 4. Prefer a versioned release archive over cloning a moving default branch. 5. Avoid global installation by default. Install into an isolated, project-specific skill directory unless global availability is explicitly required. 6. Review the downloaded manifest, skill instructions, and executable scripts before activating the skill. 7. Document the exact reviewed CLI version, repository commit, artifact checksum, and expected file list so users can verify that their installed copy matches the audited artifact. ]]>