Skip to content

fix(skills): use non-resolvable placeholders for example package names (#114)#118

Merged
lsetiawan merged 2 commits into
mainfrom
fix/issue-114-placeholder-package-names
Jul 8, 2026
Merged

fix(skills): use non-resolvable placeholders for example package names (#114)#118
lsetiawan merged 2 commits into
mainfrom
fix/issue-114-placeholder-package-names

Conversation

@lsetiawan

Copy link
Copy Markdown
Member

Summary

Fixes #114. A security researcher (Blue Bear Security) reported that the scientific-documentation skill instructs users to run pip install sphinx-extension-name — a registry-resolvable placeholder name. Because skills in this repo are markdown that coding agents execute literally, and the name resolves on PyPI, copy-pasting the command installs a third-party package whose sdist can run arbitrary code via setup.py (dependency-confusion / typosquat class). sphinx-extension-name and package-name are now live on PyPI (the former published defensively by the reporter), so this is not hypothetical.

Rather than fix only the one cited line, this PR sweeps the whole repo for the underlying class — registry-resolvable placeholder names in agent-executed package commands — and wraps each in <angle-brackets> so the name cannot resolve on any registry and the shell errors out instead of silently installing a squatted package.

Changes

48cd418 — placeholder install commands (9 files)

File Fix
scientific-documentation/references/common-issues.md sphinx-extension-name<sphinx-extension-name> (+ real example sphinx-copybutton)
community-health-files/assets/readme-template.md package-name<package-name> (pip/cargo/npm)
python-packaging/references/metadata.md, assets/readme-template.md my-sci-package<my-sci-package> (was unclaimed on PyPI)
scientific-documentation/SKILL.md, assets/index-template.md package / mypackage<package-name> / <mypackage>
pixi-package-manager/references/common-issues.md pixi add my-package<my-package>
singularity-apptainer/SKILL.md new_package<package-name>
holoviz-visualization/.../troubleshooting/README.md pip install X<missing-library>; jupyterlab_pyvizpyviz_comms (the real package shipping that extension)

43ae887npx type-scale-generator in typography-systems/SKILL.md

A whole-repo scan caught one the install-command grep missed because it's an npx invocation: the name is unclaimed on npm (HTTP 404) — identical RCE-via-typosquat risk. Replaced with the by-hand method already documented in that step.

Notes

  • validate-project-handoff.md:133 keeps pip install my-package intentionally — it's inside illustrative report output (a validator's finding), not an install instruction.
  • All other pip/npx/uvx/conda/gem names across tracked skills were verified as claimed on their registries.
  • The broader scan surfaced three unrelated findings (a marketplace.json duplicate-key CI scan-bypass, a broken secret-scan regex in validate-plugins.yml, and an unpinned :latest MCP image); these are out of scope for this branch and are being tracked separately.

Test plan

  • Every changed placeholder verified to no longer resolve on its registry (angle-bracketed names are non-resolvable; type-scale-generator removed).
  • Real substitutions verified to exist on their registry (sphinx-copybutton, pyviz_comms).
  • grep confirms no remaining bare registry-resolvable placeholder in an agent-executed install/run command.

🤖 Generated with Claude Code

lsetiawan added 2 commits July 8, 2026 15:20
Skill docs instructed users to run commands like
`pip install sphinx-extension-name` and `pip install package-name`.
These placeholder names are real, claimable names on PyPI/npm/crates.io
(several are already registered by third parties), so copying the
command verbatim installs an untrusted package and can execute
arbitrary code via its sdist setup.py — a dependency-confusion risk
reported in #114.

Wrap every registry-resolvable placeholder in angle brackets so the
name cannot resolve on any registry and the shell errors out instead of
silently installing a squatted package. Also point the JupyterLab 3+
HoloViz instruction at pyviz_comms, the real package that ships the
@pyviz/jupyterlab_pyviz extension (jupyterlab_pyviz itself is unclaimed
on PyPI).

Closes #114
…skill

The typography-systems skill instructed agents to run
`npx type-scale-generator` in its build workflow, but that npm name is
unclaimed (registry returns 404). npx would fetch and execute whatever
an attacker registers under that name — the same agent-executed
dependency-confusion class as #114, which the pip/npm-install sweep
missed because it was an `npx` invocation.

Replace it with the by-hand method already described plus the existing
worked example. All other npx/uvx names in tracked skills verified as
claimed on their registries.

Refs #114
@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

🔍 Tessl Skill Review

plugins/containerization/skills/singularity-apptainer/SKILL.md

⚠️ Error: ✘ Skill review requires you to be logged in. Run tessl login to log in, then try again.

Note: tessl skill review is deprecated – use tessl review run instead.
Migration guide: https://docs\.tessl\.io/improving\-your\-skills/migrate\-from\-skill\-review


plugins/scientific-python-development/skills/scientific-documentation/SKILL.md

⚠️ Error: ✘ Skill review requires you to be logged in. Run tessl login to log in, then try again.

Note: tessl skill review is deprecated – use tessl review run instead.
Migration guide: https://docs\.tessl\.io/improving\-your\-skills/migrate\-from\-skill\-review


plugins/uiux-design-team/skills/typography-systems/SKILL.md

⚠️ Error: ✘ Skill review requires you to be logged in. Run tessl login to log in, then try again.

Note: tessl skill review is deprecated – use tessl review run instead.
Migration guide: https://docs\.tessl\.io/improving\-your\-skills/migrate\-from\-skill\-review


To improve your score, point your agent at the Tessl optimization guide. Need help? Jump on our Discord.

Feedback

Report issues with this review at tesslio/skill-review, or send private feedback from your terminal with tessl feedback.

@lsetiawan
lsetiawan merged commit 7a9c24a into main Jul 8, 2026
2 of 3 checks passed
@lsetiawan
lsetiawan deleted the fix/issue-114-placeholder-package-names branch July 8, 2026 22:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security issue in scientific-documentation skill

1 participant