T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:55
- Finding
- Unverifiable External Watcher Executable<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–61 **Vulnerability Type**: Unpinned and unauditable external executable **Risk Level**: Medium ### Vulnerable Code ```markdown Copy the template and customize: ```bash cp templates/agentpact.yaml ./agentpact.yaml ``` Run: ```bash agentpact-watcher --config agentpact.yaml ``` ``` The referenced configuration supplies credentials to the executable: ```yaml api_url: https://api.agentpact.xyz api_key: ${AGENTPACT_API_KEY} # Set in environment agent_id: ${AGENTPACT_AGENT_ID} ``` ### Technical Analysis The skill instructs users to execute `agentpact-watcher`, but the project does not include its source code or identify a verified package, official repository, immutable version, checksum, or cryptographic signature. The executable therefore falls outside the reviewed artifact, and its behavior cannot be established by auditing this project. The configuration passed to the executable references `AGENTPACT_API_KEY` and `AGENTPACT_AGENT_ID`. A malicious, compromised, or incorrectly sourced program using the documented command name could obtain these values through configuration expansion or the process environment. It could then impersonate the agent and invoke authenticated AgentPact operations. This is a supply-chain trust weakness rather than evidence that the named watcher is itself malicious. Exploitation depends on the user obtaining an attacker-controlled or compromised executable. ### Attack Path 1. The user follows the skill documentation and attempts to obtain `agentpact-watcher`. 2. Because no authoritative installation source, pinned version, checksum, or signature is specified, the user installs or executes a compromised or spoofed implementation. 3. The user exports `AGENTPACT_API_KEY` and `AGENTPACT_AGENT_ID` as instructed and launches the executable with `agentpact.yaml`. 4. The executable reads the credentials from the environment or expanded configuration. 5. It us ...[truncated 951 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the complete watcher source code in the audited project, or provide an explicit link to its official source repository and package registry entry. 2. Document an exact installation command using a pinned, immutable package version or source commit rather than an unversioned executable name. 3. Publish and verify a cryptographic checksum or package signature before execution. 4. Document the expected publisher identity and signature-verification procedure so users can detect spoofed packages. 5. Run the watcher under a dedicated, least-privileged operating-system account with restricted filesystem and network access. 6. Use a narrowly scoped and revocable API credential. Avoid exposing unrelated secrets to the watcher process. 7. Require explicit user confirmation before proposals or other financial actions, even if automatic marketplace behavior is enabled. 8. Record authenticated actions in tamper-resistant audit logs and provide a documented credential-rotation and revocation procedure. ]]>