T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:82
- Finding
- Unpinned Third-Party Package Execution in Installation Instructions## Vulnerability Details **File Location**: `SKILL.md:82` **Vulnerability Type**: Unpinned package execution through `npx` **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the third-party `skills` npm package through `npx` without specifying an exact package version or integrity hash. Depending on the local npm configuration and cache state, `npx` may retrieve the currently resolved package from the configured registry and execute its CLI code. Consequently, the code executed during installation is not necessarily the same code that was reviewed when this skill was audited. Registry compromise, package-account compromise, dependency confusion caused by an untrusted registry configuration, or a malicious future package release could turn this installation command into an arbitrary-code execution channel. The `-g` option also causes the requested agent skill to be installed globally. While it does not itself grant operating-system administrative privileges, it broadens the persistence and exposure of any compromised skill content across the user's agent environment. ### Attack Path 1. An attacker compromises the publisher account, registry package, package dependency, or registry resolution path associated with the unpinned `skills` package. 2. The attacker publishes or serves a malicious version containing harmful CLI or lifecycle behavior. 3. A user follows `SKILL.md` and runs the documented `npx skills add ... -g` command. 4. `npx` resolves and retrieves the unpinned package from the configured registry. 5. The package executes with the invoking user's operating-system privileges. 6. Malicious code can access resources available to that user and may alter globally installed agent skill content. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user running the installa ...[truncated 471 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer to an exact, reviewed version rather than allowing `npx` to resolve the latest available release: ```bash npx --yes skills@<audited-exact-version> add zhaoxinghua09-cell/agent-skills ``` 2. Commit a lockfile and verify npm integrity metadata when the installer is managed as a project dependency. 3. Document the expected npm registry, package publisher, audited version, and release checksum or signature. 4. Prefer a locally installed, locked dependency invoked with `npx --no-install` so installation does not silently retrieve executable code: ```bash npx --no-install skills add zhaoxinghua09-cell/agent-skills ``` 5. Avoid global installation unless it is operationally required. Install into a user-scoped, isolated skill directory and review downloaded skill files before activation. 6. Retain the documented manual Git installation as the safer alternative, but pin it to a reviewed commit hash or signed release instead of a mutable branch. 7. Run installation without administrator privileges and in a restricted environment where practical.