T08 · Insecure Dependencies
Warning
- Location
SKILL.md:163- Finding
Unpinned Third-Party Skill Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 163–166
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: MediumVulnerable Code
markdown 写完后建议用 **eval-skill** 检查 skill 质量： ```bash clawhub install eval-skilltext ### Technical Analysis The Skill recommends installing the third-party `eval-skill` package without specifying an immutable version, cryptographic digest, verified publisher, or trusted registry. Consequently, the installed content may differ from the content originally intended or reviewed. This creates a supply-chain risk: if the package name is compromised, transferred, replaced, or updated maliciously, following the recommendation could install attacker-controlled Skill instructions or executable components. The instruction is optional, which reduces likelihood, but it still presents an unsafe dependency acquisition pattern. ### Attack Path 1. An attacker compromises the `eval-skill` package, its publisher account, or the registry entry that resolves the package name. 2. The attacker publishes a malicious release under the same unversioned package identifier. 3. A user or Agent follows the recommendation and executes `clawhub install eval-skill`. 4. The package manager resolves the mutable identifier to the malicious release. 5. The installed Skill is subsequently loaded or invoked. 6. Its malicious instructions or scripts execute within the permissions available to the Agent and its tools. ### Impact Assessment Successful exploitation could allow malicious package content to operate with the permissions granted to the installing or invoking Agent. Depending on the package manager, Agent configuration, and enabled tools, this could expose accessible workspace data, influence Agent behavior, invoke local commands, or interact with configured external services. No malicious payload is included in the audited project itself, and exploitation requires installation and subsequent use ...[truncated 137 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
eval-skillto a reviewed immutable version or content digest rather than installing by an unversioned name. - Specify the expected publisher and an approved registry or repository.
- Verify package signatures or checksums before installation where supported.
- Require explicit user confirmation before installing third-party content.
- Document the package's expected permissions, scripts, network activity, and accessible resources.
- Review the resolved package contents before loading or executing them.
- Prefer bundling an audited evaluator with the project when licensing and maintenance constraints permit.
- Establish a controlled update process so newer releases are reviewed before changing the pinned version.
- Pin