T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:82
- Finding
- Unpinned Third-Party Installer Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, line 82 **Vulnerability Type**: Unpinned execution of a third-party package installer **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add zhaoxinghua09-cell/agent-skills -g ``` ### Technical Analysis The documented installation command invokes the `skills` npm package through `npx` without specifying an immutable package version. Consequently, the code retrieved and executed by `npx` can differ from the code available when this skill was audited. The command also requests a global installation of skill content from `zhaoxinghua09-cell/agent-skills`, whose default branch is mutable. Although the audited local Python script has no external dependencies or malicious behavior, this installation method introduces additional code and content that are outside the reviewed artifact. This is a supply-chain risk rather than evidence that the current npm package or repository is compromised. Exploitation would require compromise or malicious modification of the package, its publication account, the upstream repository, or the dependency-resolution path. ### Attack Path 1. An attacker compromises the unpinned `skills` npm package, its publisher account, or another component selected during package resolution. 2. Alternatively, an attacker modifies content in the mutable upstream skill repository before installation. 3. A user follows the documented command and runs `npx skills add zhaoxinghua09-cell/agent-skills -g`. 4. `npx` downloads and executes the package version resolved at that time rather than a previously audited immutable version. 5. The installer retrieves and globally installs the then-current repository content. 6. Malicious installer code could execute immediately, while malicious skill code or instructions could be activated when the installed skill is later loaded. ### Impact Assessment If the dependency or upstream source is compromised, i ...[truncated 644 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` npm package to a reviewed, exact version: ```bash npx skills@<reviewed-exact-version> add zhaoxinghua09-cell/agent-skills -g ``` 2. Pin downloaded repository content to an immutable commit SHA or signed release instead of relying on a mutable default branch. 3. Publish and verify cryptographic checksums or signatures for released skill packages. 4. Avoid global installation by default. Prefer installation into an isolated user-level directory or disposable environment. 5. Document that users should inspect downloaded scripts and skill instructions before activation. 6. Use npm lockfiles and integrity metadata where an npm-managed installation workflow is available. 7. Recommend running the installer without elevated privileges and with only the minimum filesystem and credential access necessary.