T08 · Insecure Dependencies
Warning
- Location
scripts/skill_market_publish.py:1604- Finding
Unpinned npm Package Retrieval and Execution with Inherited Environment
- Content
View full analysis
dict[str, Any]: try: command = build_skills_sh_command(context, args) except ValueError as exc: fail(str(exc)) if not execute: dry_run_output( "skills-sh", { "command": command, "temporary_project_directory": "created at execution time and deleted after the command exits", "source": skills_sh_source(context), "skill": context["skill"]["name"], }, ) return {"dry_run": True, "command": command} blockers = skills_sh_telemetry_blockers() if blockers: fail( "skills.sh indexing depends on anonymous skills CLI telemetry. " f"Unset these environment variables before executing: {', '.join(blockers)}" ) with tempfile.TemporaryDirectory(prefix="skills-sh-publish-") as temp_dir: temp_path = Path(temp_dir) result = subprocess.run( command, cwd=temp_path, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, ) temp_path_text = str(temp_path) ``` The command defaults to an unversioned npm package: ```python sub.add_argument( "--skills-sh-bin", default="npx -y skills", help="Command prefix for the skills CLI used by the skills.sh adapter", ) ``` The documentation also directs operators to use the same unpinned command: ```markdown - run `npx ...[truncated 2739 chars]- Remediation
View remediation