T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:76
- Finding
- Unpinned npm CLI Execution in Installation Instructions## Vulnerability Details **File Location**: `SKILL.md`, line 76 **Vulnerability Type**: Supply-chain risk from an unpinned executable dependency **Risk Level**: Medium **Complete Code Snippet**: ```bash # One-command installation using the Skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying an exact package version or verifying its integrity. Depending on the local npm cache and configuration, `npx` may retrieve and execute mutable package content from the npm registry. This installation mechanism is not required by the Skill's core functionality. The actual runtime component, `scripts/prompt_injection_drill.py`, uses only the Python standard library and does not require npm. The unpinned CLI therefore expands the trust boundary and execution surface beyond the minimum privileges and dependencies needed to generate prompt-injection test cases. This finding does not establish that the current `skills` package is malicious. The vulnerability is that future or compromised registry content may be executed without ensuring that it matches an audited version. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or the relevant package publication process. 2. The attacker publishes a malicious or modified release under the package name resolved by `npx skills`. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx` downloads and executes the mutable package version. 5. Malicious CLI or lifecycle behavior runs with the invoking user's privileges. 6. Because the command requests global installation through `-g`, modified Skill content may be placed into globally managed locations accessible to that user. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running the installation comma ...[truncated 506 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to a reviewed, immutable version, for example: ```bash npx --yes skills@<reviewed-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Verify the package version and integrity against trusted release metadata before execution. 3. Avoid global installation where possible; install into a dedicated, non-privileged environment. 4. Prefer the documented Git installation method, but pin the repository to a reviewed commit or signed release rather than cloning a mutable branch: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout <reviewed-commit-hash> ``` 5. Document the expected package publisher, exact version, checksums, and verification procedure. 6. Since the runtime script is standard-library-only, offer a direct installation method that copies the audited files without executing an unrelated package manager CLI.