fix(security): commit-pin GitHub skill-pack installs (taste-skill, remotion, higgsfield)

fidgetcoding · fidgetcoding · commit 69cdeead8215 · 2026-07-03T15:12:31.000-04:00
The skills CLI (v1.5.14) has no ref-pinning syntax, so install_skill_pack_pinned
clones + checks out an audited SHA and installs each SKILL.md by its name:
frontmatter, replicating the CLI's discovery layout. Higgsfield clone pinned
too (was unpinned HEAD). Sandbox-tested: 13/13 taste skills at pin; bad SHA
soft-fails clean.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -23,7 +23,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Git history rewrite: `git filter-repo` collapsed all author/committer identities into a single `the operator <operator@example.com>` identity across `main` and the v1.0.0 tag. All `Co-authored-by:` trailers stripped. Tag commit hash for v1.0.0 changed; this repo has no published npm artifact, so no downstream impact.
 
 ### Fixed
-- **MCP registrations version-pinned at install time** (rug-pull defense, /safetycheck Checks 22/24 — same remediation as cli-maxxing). New `pin_npm` helper in `design/install.sh` + `media/install.sh` resolves the currently published version via `npm view` and registers `pkg@x.y.z` instead of a floating ref, so the command written into Claude's config stops re-resolving to whatever is newest on npm at every session start. Covers all five npm-backed registrations: `@21st-dev/magic` + `@playwright/mcp` (design, previously `@latest`) and `@kimtaeyoon83/mcp-server-youtube-transcript` + `@kevinwatt/yt-dlp-mcp` + `whisper-mcp` (media, previously `@latest`/versionless). Falls back to `@latest` only when npm/network is unavailable at install time. Known remaining floats, deferred deliberately: the `npx skills add` installs (taste-skill, remotion) — the skills CLI documents no ref-pinning syntax — and the one-shot `@anthropic-ai/claude-code` invoker fallback, which runs once at install and never persists into config.
+- **MCP registrations version-pinned at install time** (rug-pull defense, /safetycheck Checks 22/24 — same remediation as cli-maxxing). New `pin_npm` helper in `design/install.sh` + `media/install.sh` resolves the currently published version via `npm view` and registers `pkg@x.y.z` instead of a floating ref, so the command written into Claude's config stops re-resolving to whatever is newest on npm at every session start. Covers all five npm-backed registrations: `@21st-dev/magic` + `@playwright/mcp` (design, previously `@latest`) and `@kimtaeyoon83/mcp-server-youtube-transcript` + `@kevinwatt/yt-dlp-mcp` + `whisper-mcp` (media, previously `@latest`/versionless). Falls back to `@latest` only when npm/network is unavailable at install time. Known remaining float, deferred deliberately: the one-shot `@anthropic-ai/claude-code` invoker fallback, which runs once at install and never persists into config.
+- **GitHub skill-pack installs commit-pinned** (closes the deferred `npx skills add` float from the entry above). New `install_skill_pack_pinned` helper (design + media): clones the pack repo, checks out an audited SHA, and copies each `SKILL.md`'s directory to `~/.claude/skills/<name>/` by its `name:` frontmatter — replicating the skills CLI's `skills/<name>/SKILL.md` discovery deterministically, since the CLI (v1.5.14) has no ref-pinning syntax. Pins: taste-skill @ `06d6028` (13 skills at this commit; the 8 canonical names still anchor the count check), remotion-dev/skills @ `8dad6ec`, and the Higgsfield seedance repo clone @ `83dcb10` (was an unpinned `--depth 1` HEAD clone). Sandbox-tested against the live taste-skill repo: 13/13 installed at the pin; a bad SHA soft-fails without partial installs. Bump the `*_COMMIT` constants to update.
 - Printed manual-install curl commands for the whisper model (`media/install.sh` help strings) now carry `--proto '=https' --proto-redir '=https'` so copy-pasted commands match the hardened executed ones.
 - Excalidraw MCP URL aligned with the official OSS README (no more pointing at the wrong upstream).
 - Added `set -e` to `design/install.sh` so a partial install fails loud instead of silently leaving missing tools on disk.
diff --git a/design/install.sh b/design/install.sh
@@ -39,6 +39,44 @@ pin_npm() {
     if [ -n "$v" ]; then echo "$1@$v"; else echo "$1@latest"; fi
 }
 
+# Install a GitHub skill pack at a pinned commit (rug-pull defense). The
+# `skills` CLI (v1.5.14) has no ref-pinning syntax, so we clone + checkout the
+# audited SHA ourselves and copy each SKILL.md's directory to
+# ~/.claude/skills/<name>/ using its `name:` frontmatter — replicating the
+# CLI's default skills/<name>/SKILL.md discovery deterministically.
+# Args: $1 = repo URL, $2 = pinned commit SHA, $3 = label
+install_skill_pack_pinned() {
+    local url="$1" sha="$2" label="$3"
+    local tmp
+    tmp="$(mktemp -d)"
+    if ! git clone --quiet "$url" "$tmp" 2>/dev/null; then
+        rm -rf "$tmp"
+        soft_fail "$label: clone failed ($url)"
+        return 1
+    fi
+    if ! git -C "$tmp" checkout --quiet "$sha" 2>/dev/null; then
+        rm -rf "$tmp"
+        soft_fail "$label: pinned commit $sha not found upstream"
+        return 1
+    fi
+    local search_root="$tmp"
+    if [ -d "$tmp/skills" ]; then search_root="$tmp/skills"; fi
+    local installed=0
+    local skill_md name dest
+    while IFS= read -r skill_md; do
+        name="$(sed -n 's/^name:[[:space:]]*//p' "$skill_md" | head -1 | tr -d '"' | tr -d "'")"
+        if [ -z "$name" ]; then continue; fi
+        dest="$HOME/.claude/skills/$name"
+        if [ -f "$dest/SKILL.md" ]; then continue; fi
+        mkdir -p "$dest"
+        cp -R "$(dirname "$skill_md")/." "$dest/"
+        installed=$((installed + 1))
+    done < <(find "$search_root" -name SKILL.md -not -path '*/.git/*' 2>/dev/null)
+    rm -rf "$tmp"
+    success "$label installed ($installed new, pinned @ ${sha:0:7})"
+    return 0
+}
+
 # -----------------------------------------------------------------------------
 # Detect OS
 # -----------------------------------------------------------------------------
@@ -124,7 +162,9 @@ install_uiux_skill() {
 
 # -----------------------------------------------------------------------------
 # Install Taste Skill (Leonxlnx/taste-skill)
-# Upstream ships 8 skills whose `name:` frontmatter drives their installed path:
+# Upstream ships 13 skills at the pinned commit, whose `name:` frontmatter
+# drives their installed path. The 8 canonical ones below anchor the
+# installed-count verification:
 #   design-taste-frontend, high-end-visual-design, full-output-enforcement,
 #   redesign-existing-projects, stitch-design-taste, minimalist-ui,
 #   industrial-brutalist-ui, gpt-taste
@@ -160,16 +200,12 @@ install_taste_skill() {
 
     info "Installing Taste Skill pack (Leonxlnx/taste-skill)..."
 
-    local TASTE_SKILL_URL="https://github.com/Leonxlnx/taste-skill"
-
-    npx skills add "$TASTE_SKILL_URL" --yes --global 2>/dev/null
+    # Pinned to an audited commit — bump TASTE_COMMIT to update.
+    local TASTE_COMMIT="06d6028b5c623016c59ce8536f578e5a1127b499"
+    install_skill_pack_pinned "https://github.com/Leonxlnx/taste-skill" "$TASTE_COMMIT" "Taste Skill pack" || true
 
     local after_count
     after_count="$(taste_installed_count)"
-    if [ "$after_count" -lt 8 ]; then
-        npx skills add "$TASTE_SKILL_URL" --yes 2>/dev/null
-        after_count="$(taste_installed_count)"
-    fi
 
     if [ "$after_count" -ge 8 ]; then
         success "Taste Skill installed ($after_count/8 variants under ~/.claude/skills/)"
diff --git a/media/install.sh b/media/install.sh
@@ -43,6 +43,44 @@ pin_npm() {
     if [ -n "$v" ]; then echo "$1@$v"; else echo "$1@latest"; fi
 }
 
+# Install a GitHub skill pack at a pinned commit (rug-pull defense). The
+# `skills` CLI (v1.5.14) has no ref-pinning syntax, so we clone + checkout the
+# audited SHA ourselves and copy each SKILL.md's directory to
+# ~/.claude/skills/<name>/ using its `name:` frontmatter — replicating the
+# CLI's default skills/<name>/SKILL.md discovery deterministically.
+# Args: $1 = repo URL, $2 = pinned commit SHA, $3 = label
+install_skill_pack_pinned() {
+    local url="$1" sha="$2" label="$3"
+    local tmp
+    tmp="$(mktemp -d)"
+    if ! git clone --quiet "$url" "$tmp" 2>/dev/null; then
+        rm -rf "$tmp"
+        soft_fail "$label: clone failed ($url)"
+        return 1
+    fi
+    if ! git -C "$tmp" checkout --quiet "$sha" 2>/dev/null; then
+        rm -rf "$tmp"
+        soft_fail "$label: pinned commit $sha not found upstream"
+        return 1
+    fi
+    local search_root="$tmp"
+    if [ -d "$tmp/skills" ]; then search_root="$tmp/skills"; fi
+    local installed=0
+    local skill_md name dest
+    while IFS= read -r skill_md; do
+        name="$(sed -n 's/^name:[[:space:]]*//p' "$skill_md" | head -1 | tr -d '"' | tr -d "'")"
+        if [ -z "$name" ]; then continue; fi
+        dest="$HOME/.claude/skills/$name"
+        if [ -f "$dest/SKILL.md" ]; then continue; fi
+        mkdir -p "$dest"
+        cp -R "$(dirname "$skill_md")/." "$dest/"
+        installed=$((installed + 1))
+    done < <(find "$search_root" -name SKILL.md -not -path '*/.git/*' 2>/dev/null)
+    rm -rf "$tmp"
+    success "$label installed ($installed new, pinned @ ${sha:0:7})"
+    return 0
+}
+
 # -----------------------------------------------------------------------------
 # Detect OS
 # -----------------------------------------------------------------------------
@@ -95,18 +133,14 @@ install_remotion_skills() {
         return
     fi
 
-    npx skills add remotion-dev/skills --yes --global 2>/dev/null
+    # Pinned to an audited commit — bump REMOTION_COMMIT to update.
+    local REMOTION_COMMIT="8dad6ec5c5c7cedee4d2aa620bb68386f8fe8eb9"
+    install_skill_pack_pinned "https://github.com/remotion-dev/skills" "$REMOTION_COMMIT" "Remotion skills" || true
 
     if [ -d "$HOME/.claude/skills/remotion-best-practices" ] || [ -L "$HOME/.claude/skills/remotion-best-practices" ]; then
         success "Remotion skills installed for Claude Code"
     else
-        npx skills add remotion-dev/skills --yes 2>/dev/null
-
-        if [ -d "$HOME/.claude/skills/remotion-best-practices" ] || [ -L "$HOME/.claude/skills/remotion-best-practices" ]; then
-            success "Remotion skills installed"
-        else
-            soft_fail "Remotion skills installation could not be verified"
-        fi
+        soft_fail "Remotion skills installation could not be verified"
     fi
 }
 
@@ -155,8 +189,11 @@ install_higgsfield_skills() {
     # local, so guard the expansion or set -u kills the run after this returns.
     trap 'rm -rf "${_TMP:-}"' RETURN
 
-    if ! git clone --quiet --depth 1 https://github.com/beshuaxian/higgsfield-seedance2-jineng.git "$_TMP" 2>/dev/null; then
-        soft_fail "Could not clone Higgsfield repo — skipping. Install manually: https://github.com/beshuaxian/higgsfield-seedance2-jineng"
+    # Pinned to an audited commit (rug-pull defense) — bump HIGGS_COMMIT to update.
+    local HIGGS_COMMIT="83dcb10ee38c9694ac0f455ec55a62f2be3b8a14"
+    if ! git clone --quiet https://github.com/beshuaxian/higgsfield-seedance2-jineng.git "$_TMP" 2>/dev/null \
+        || ! git -C "$_TMP" checkout --quiet "$HIGGS_COMMIT" 2>/dev/null; then
+        soft_fail "Could not clone Higgsfield repo at pinned commit ${HIGGS_COMMIT:0:7} — skipping. Install manually: https://github.com/beshuaxian/higgsfield-seedance2-jineng"
         return
     fi
 
