T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Unpinned CLI Execution and Non-Interactive Global Installation of Third-Party Skills## Vulnerability Details **File Location**: `SKILL.md:26-29`, `SKILL.md:48`, and `SKILL.md:84-88` **Vulnerability Type**: Supply-chain risk caused by unpinned dependencies and insufficient validation of third-party packages **Risk Level**: Medium **Vulnerable Code Snippets**: `SKILL.md:26-29` ```bash npx skills find [query] npx skills add <package> npx skills check npx skills update ``` `SKILL.md:48` ```bash npx skills find [query] ``` `SKILL.md:84-88` ```bash npx skills add <owner/repo@skill> -g -y ``` ### Technical Analysis The documented workflow executes the `skills` npm CLI through `npx` without pinning it to a reviewed version. Package resolution can therefore select the version currently published under that npm package name rather than an immutable, previously audited artifact. The workflow subsequently recommends installing skills returned by an external discovery service. It permits packages from GitHub or other sources but does not require validation of the repository owner, immutable commit, package integrity, dependency tree, or downloaded skill contents. The suggested installation command uses both `-g` and `-y`. Global installation expands the package's availability beyond the current project, while non-interactive confirmation reduces the opportunity for the user to inspect the source and resolved package identity before installation. If the CLI package, search results, repository, maintainer account, or downstream dependency is compromised, attacker-controlled installation behavior or skill instructions could be introduced. This is a supply-chain weakness rather than evidence that the currently documented CLI or any specific referenced repository is malicious. ### Attack Path 1. An attacker compromises the `skills` npm package, a listed skill repository, its maintainer account, or a downstream dependency. Alternatively, the attacker publishes a deceptive or similarly n ...[truncated 1748 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to an exact, reviewed version: ```bash npx --yes skills@<exact-reviewed-version> find [query] ``` Record the approved version and update it only after review. 2. Remove automatic confirmation from installation commands. Require explicit user approval immediately before any package is installed: ```bash npx skills@<exact-reviewed-version> add <owner/repo@skill> ``` 3. Prefer project-local or sandboxed installation instead of `-g`. Global installation should be an explicit exception with a documented justification. 4. Pin installed skills to immutable commit hashes or cryptographically verifiable releases rather than mutable branches or tags. 5. Before installation, verify: - The exact repository owner and canonical repository URL. - The selected commit or release. - Package checksums or integrity metadata, where supported. - Install scripts and dependency manifests. - The complete skill instructions and any bundled executable files. - Maintainer reputation and repository history. 6. Restrict installation to an allowlist of reviewed owners and repositories. Do not automatically trust identifiers returned by external search results. 7. Perform installation and initial execution in a sandbox with restricted filesystem, credential, environment-variable, and network access. 8. Display the resolved package identity, version, source URL, and requested installation scope to the user before requesting approval.