T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 27–37 **Vulnerability Type**: Unpinned third-party dependencies installed through `npx` **Risk Level**: Medium **Affected code:** ```markdown - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup ``` ``` ### Technical Analysis The installation commands retrieve and install externally maintained components without specifying an immutable version, release tag, or commit digest. The invocation through `npx` may also obtain the `skills` installer dynamically if it is not already present in the local package cache. Consequently, the code and instructions installed by these commands can differ from the content that was available when this skill was audited. A compromise of the upstream repository, package-publishing account, dependency chain, or distribution service could cause later installations to receive attacker-controlled content. Similar unpinned installation references are repeated for Google Sheets, Google Drive, Plaud, and speech-to-text skills elsewhere in `SKILL.md`. The identified lines demonstrate the underlying dependency-management pattern. ### Attack Path 1. An attacker compromises an upstream publisher account, the `Agent ...[truncated 1521 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` installer to a reviewed, exact package version instead of allowing `npx` to resolve the latest release. 2. Pin `AgentPMT/agent-skills` to an immutable commit SHA or cryptographically verified release rather than a mutable repository reference. 3. Record and verify expected checksums or signed provenance for every installed skill. 4. Use a lockfile or equivalent dependency manifest and enforce reproducible installation in CI. 5. Mirror reviewed dependencies into a controlled registry or repository when the platform supports it. 6. Apply the same pinning requirements to all other installation commands in `SKILL.md`, including Google Sheets, Google Drive, Plaud, and speech-to-text skills. 7. Run newly installed skills with least-privilege credentials and review any upstream update before granting access to recording, Drive, or Sheets data. 8. Add automated checks that reject mutable dependency references and unpinned `npx` invocations.