T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:108
- Finding
- Unpinned npx Package Creates a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:108` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation procedure invokes the `skills` package through `npx` without specifying an audited version or verifying package integrity. If the package is not already available locally, `npx` may retrieve the currently published version from the configured package registry and execute it. The effective code executed by this command can therefore change independently of the reviewed Skill package. The repository reference supplied as an argument does not pin or authenticate the executable `skills` package itself. No evidence indicates that the current package is malicious. The vulnerability is the mutable and unverified supply-chain trust boundary introduced by the installation instructions. ### Attack Path 1. An attacker compromises the registry account, publication process, or upstream package associated with the unpinned `skills` command. 2. The attacker publishes a malicious package version under the expected package name. 3. A user follows the documented installation command. 4. `npx` retrieves the mutable package version and executes its lifecycle or command code. 5. The malicious package runs with the privileges of the invoking user and may modify files accessible to that account. ### Impact Assessment Successful exploitation could execute arbitrary code with the invoking user's privileges. Accessible scope could include user files, environment variables, agent configuration, and globally writable package or Skill directories. The command does not itself demonstrate privilege escalation to an administrator or root account; the maximum privileges are those already held by the user running it. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the CLI to a specifically audited version, for example `npx skills@<approved-version> ...`. - Document the expected registry, package publisher, and package checksum or provenance information. - Prefer a lockfile-backed installation or a locally verified CLI artifact. - Avoid global installation unless it is operationally necessary. - Use package-manager options that prevent unexpected lifecycle scripts where supported. - Require users to verify the package signature, integrity hash, or trusted release provenance before execution. ]]>