T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:82
- Finding
- Unpinned Third-Party Installer and Mutable Repository Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 82-87 **Vulnerability Type**: Supply-chain exposure through unpinned executable tooling and mutable remote sources **Risk Level**: Medium **Vulnerable code:** ```bash npx skills add zhaoxinghua09-cell/agent-skills -g git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/prompt-injection-shield ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation procedure invokes `npx skills` without specifying an audited package version or integrity digest. Depending on the local npm environment, `npx` can retrieve and execute the current published version of the package. The effective installer code may therefore differ from the version reviewed during this audit. The alternative installation procedure clones a mutable repository reference without pinning an immutable commit hash or signed release tag. It then copies Skill content into the user's Agent configuration directory. The repository contains more content than the audited artifact, so the command establishes trust in remote, unaudited repository state. The `-g` option also increases the installation scope. Although it does not inherently grant operating-system administrator privileges, it may make remotely obtained content available across the user's Agent environments. This finding concerns the documented installation procedure. The included `scripts/prompt_injection_scan.py` does not itself perform network requests, execute subprocesses, or retrieve remote payloads. ### Attack Path 1. An attacker compromises the npm package resolved by `npx skills`, its publisher account, or an upstream dependency used by that installer; alternatively, the attacker compromises the referenced GitHub repository. 2. The attacker publishes modified installer behavior or malicious Skill content after this artifact has been audited. 3. A user follows the installation instruct ...[truncated 1009 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the npm CLI to a specifically reviewed version rather than invoking an unversioned package: ```bash npx --yes skills@AUDITED_VERSION add OWNER/REPOSITORY@IMMUTABLE_COMMIT ``` Confirm that the selected CLI supports immutable repository references before recommending this syntax. 2. Pin Git installation instructions to an immutable, reviewed commit: ```bash git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cd agent-skills git checkout --detach AUDITED_COMMIT_HASH ``` 3. Publish SHA-256 checksums or signed release attestations for the Skill files and require users to verify them before installation. 4. Prefer a release archive containing only this Skill over cloning and trusting the entire repository. 5. Avoid global installation by default. Install into a dedicated, least-privileged Agent directory unless cross-environment availability is explicitly required. 6. Document the exact package version, repository commit, expected file hashes, and verification procedure associated with each audited release. 7. Recommend reviewing downloaded files before loading the Skill, particularly executable scripts and Agent instruction files.