Skill docs instructed users to run commands like
`pip install sphinx-extension-name` and `pip install package-name`.
These placeholder names are real, claimable names on PyPI/npm/crates.io
(several are already registered by third parties), so copying the
command verbatim installs an untrusted package and can execute
arbitrary code via its sdist setup.py — a dependency-confusion risk
reported in #114.
Wrap every registry-resolvable placeholder in angle brackets so the
name cannot resolve on any registry and the shell errors out instead of
silently installing a squatted package. Also point the JupyterLab 3+
HoloViz instruction at pyviz_comms, the real package that ships the
@pyviz/jupyterlab_pyviz extension (jupyterlab_pyviz itself is unclaimed
on PyPI).
Closes #114
Summary
Fixes #114. A security researcher (Blue Bear Security) reported that the
scientific-documentationskill instructs users to runpip install sphinx-extension-name— a registry-resolvable placeholder name. Because skills in this repo are markdown that coding agents execute literally, and the name resolves on PyPI, copy-pasting the command installs a third-party package whose sdist can run arbitrary code viasetup.py(dependency-confusion / typosquat class).sphinx-extension-nameandpackage-nameare now live on PyPI (the former published defensively by the reporter), so this is not hypothetical.Rather than fix only the one cited line, this PR sweeps the whole repo for the underlying class — registry-resolvable placeholder names in agent-executed package commands — and wraps each in
<angle-brackets>so the name cannot resolve on any registry and the shell errors out instead of silently installing a squatted package.Changes
48cd418— placeholder install commands (9 files)scientific-documentation/references/common-issues.mdsphinx-extension-name→<sphinx-extension-name>(+ real examplesphinx-copybutton)community-health-files/assets/readme-template.mdpackage-name→<package-name>(pip/cargo/npm)python-packaging/references/metadata.md,assets/readme-template.mdmy-sci-package→<my-sci-package>(was unclaimed on PyPI)scientific-documentation/SKILL.md,assets/index-template.mdpackage/mypackage→<package-name>/<mypackage>pixi-package-manager/references/common-issues.mdpixi add my-package→<my-package>singularity-apptainer/SKILL.mdnew_package→<package-name>holoviz-visualization/.../troubleshooting/README.mdpip install X→<missing-library>;jupyterlab_pyviz→pyviz_comms(the real package shipping that extension)43ae887—npx type-scale-generatorintypography-systems/SKILL.mdA whole-repo scan caught one the install-command grep missed because it's an
npxinvocation: the name is unclaimed on npm (HTTP 404) — identical RCE-via-typosquat risk. Replaced with the by-hand method already documented in that step.Notes
validate-project-handoff.md:133keepspip install my-packageintentionally — it's inside illustrative report output (a validator's finding), not an install instruction.pip/npx/uvx/conda/gemnames across tracked skills were verified as claimed on their registries.marketplace.jsonduplicate-key CI scan-bypass, a broken secret-scan regex invalidate-plugins.yml, and an unpinned:latestMCP image); these are out of scope for this branch and are being tracked separately.Test plan
type-scale-generatorremoved).sphinx-copybutton,pyviz_comms).grepconfirms no remaining bare registry-resolvable placeholder in an agent-executed install/run command.🤖 Generated with Claude Code