T08 · Insecure Dependencies
- Location
SKILL.md:188- Finding
Unpinned External Skill Installation Creates a Supply-Chain Execution Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 188-198
Vulnerability Type: Unpinned third-party dependencies and mutable external Skill installation
Risk Level: MediumVulnerable Code
markdown - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setuptext ### Technical Analysis The Skill recommends executing `npx skills add` against externally maintained content without pinning the `skills` CLI, repository revision, package version, or artifact checksum. Consequently, the content executed or installed at setup time can differ from the content reviewed during this audit. This is particularly sensitive because the installed Skills concern AgentPMT account, MCP, REST API, and credential setup. If the npm package, source repository, publishing account, or a transitive dependency is compromised, an attacker could distribute modified setup logic or malicious Skill instructions through an otherwise legitimate-looking command. The use of `npx` may download and run a package that is not already installed locally. Without an explicit version and integrity validation, package resolution depends on mutable registry state. The project also provides no mandatory review or trust verifi ...[truncated 1962 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin the
skillsCLI to a reviewed, explicit version instead of invoking an unspecified release:bash npx skills@REVIEWED_VERSION add AgentPMT/agent-skills --skill what-is-agentpmt -
Pin the AgentPMT Skill source to an immutable commit hash or signed release tag. Do not rely solely on a mutable repository branch or unversioned Skill name.
-
Publish and verify cryptographic checksums or signatures for downloaded Skill artifacts before installation.
-
Require users to inspect the downloaded
SKILL.md, scripts, manifests, and dependency definitions before activation, especially for account and credential setup Skills. -
Use a lockfile or equivalent dependency manifest to pin all transitive dependencies used by the installer.
-
Run installation in a restricted environment with no secrets, minimal filesystem access, and no administrative privileges.
-
Separate installation from credential configuration. Credentials should only be entered after the installed content and configured endpoints have been verified.
-
Document the expected AgentPMT API domains and require explicit confirmation before setup instructions can redirect MCP or REST traffic elsewhere.
-
Prefer distributing reviewed setup documentation locally with this Skill when practical, eliminating the need to install mutable remote instructions during use.
-