T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:59
- Finding
- Unpinned Third-Party Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59-62 **Vulnerability Type**: Unpinned and unaudited third-party dependency recommendation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Related Tools - Calculate revenue potential: https://afrexai-cto.github.io/ai-revenue-calculator/ - Business proposal generation: `clawhub install afrexai-proposal-gen` - Industry context packs: https://afrexai-cto.github.io/context-packs/ ($47/pack) ``` ### Technical Analysis The skill recommends installing `afrexai-proposal-gen` using a mutable package name. The command does not specify an immutable version or commit, an integrity checksum, an authenticated source repository, or a publisher-verification procedure. Consequently, the installed content may differ from the content that existed when this skill was reviewed. If the package registry account, distribution infrastructure, or package itself is compromised, the installation could introduce attacker-controlled instructions or executable components. This is a supply-chain weakness rather than evidence that the named package is currently malicious. The external links also direct users to third-party services, but the reviewed file neither automatically accesses those services nor requires their inclusion in generated pitch-deck reviews. ### Attack Path 1. An attacker compromises the third-party package, its publisher account, or its distribution channel. 2. The attacker publishes a malicious or modified release under the same mutable package name. 3. A user follows the documented recommendation and runs: ```shell clawhub install afrexai-proposal-gen ``` 4. The package manager resolves and installs the attacker-controlled current release because no trusted version, commit, or checksum is pinned. 5. When the installed skill is loaded or invoked, its instructions or bundled executable components may operate with the permissions available to the invoking agent or user. This ...[truncated 816 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the installation recommendation unless the third-party skill is necessary for the documented functionality. 2. Pin the dependency to an audited immutable version or source commit rather than resolving it only by package name. 3. Record and verify a cryptographic checksum or signed provenance statement before installation. 4. Identify the authoritative source repository and verified publisher so users can validate package ownership. 5. Require explicit user approval before installing or executing third-party content. 6. Review the dependency's instructions, scripts, transitive dependencies, permissions, and network behavior before recommending it. 7. Install and run optional dependencies in a least-privilege sandbox with restricted filesystem, credential, tool, and network access. 8. Document that third-party links and tools are optional and that sensitive pitch-deck information should not be submitted without reviewing the applicable privacy and data-retention policies. ]]>