T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:82
- Finding
- Unpinned Third-Party Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 82-85 **Vulnerability Type**: Unpinned third-party package and mutable repository installation **Risk Level**: Medium ```bash # One-click retrieval (skills CLI) npx skills add zhaoxinghua09-cell/agent-skills -g # Or manually: clone and copy this skill into the Agent skill directory ``` ### Technical Analysis The documented installation command invokes `npx skills` without specifying an exact package version or integrity value. If the package is not already available locally, `npx` may resolve and execute the currently published version of the third-party npm package. Consequently, the code executed at installation time can differ from the code that was reviewed during this audit. The command also retrieves content from the mutable `zhaoxinghua09-cell/agent-skills` repository and requests a global skill installation through the `-g` option. Neither the npm package nor the repository content is pinned to a reviewed immutable version or commit. A compromised package release, maintainer account, package registry, or source repository could therefore cause users to execute or install content that is not present in this audited artifact. The local `scripts/compress_prompt.py` implementation uses only the Python standard library and does not itself retrieve or execute remote code. The risk originates specifically from the documented installation path. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the package distribution channel, or the referenced source repository. 2. The attacker publishes a modified package version or changes the repository content resolved by the installation tool. 3. A user follows the documented command and runs `npx skills add zhaoxinghua09-cell/agent-skills -g`. 4. `npx` resolves and executes the mutable third-party CLI under the invoking user's account. 5. The compromised installer executes attacker-con ...[truncated 839 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to an explicitly reviewed version, for example by using an exact package version rather than an unversioned `npx` invocation. 2. Confirm and document the official npm package scope and publisher so users can distinguish it from similarly named or typosquatted packages. 3. Pin repository installation to a reviewed commit hash or signed release instead of resolving a mutable branch. 4. Verify package and artifact integrity using registry integrity metadata, checksums, or signed release artifacts where supported. 5. Avoid global installation by default. Prefer a local, least-privilege installation with a clearly documented destination. 6. Prefer distributing and installing directly from the reviewed artifact rather than fetching additional mutable content during setup. 7. Document a verification procedure that allows users to compare the downloaded script and manifest against known-good hashes before execution. 8. Advise users not to run the installer with administrative or root privileges.