T08 · Insecure Dependencies
Warning
- Location
SKILL.md:269- Finding
Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 269-279
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumThe Skill recommends installing third-party AgentPMT Skills through
npxwithout pinning a package version, repository tag, commit hash, or integrity checksum.Complete vulnerable code snippet:
markdown Core AgentPMT setup skills: - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setuptext ### Technical Analysis The installation commands resolve mutable third-party content at installation time. They provide no immutable version, commit identifier, checksum, or signature against which the downloaded content can be verified. Therefore, the effective dependency installed by a user may differ from the content that was available when this Skill was audited. The risk is amplified by the freshness instruction at `SKILL.md:14`, which recommends reinstalling the Skill after seven days: ```markdown If the current date is more than 7 days after the last updated date, reinstall this skill from skills.sh or ClawHub before relying on endpoints, schemas, setup steps, or examples.This is a supply-chain weakness rather than evidence that the curre ...[truncated 1880 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every external installer and Skill to an immutable, audited version or commit hash.
- Publish cryptographic checksums or signed provenance for each supported dependency and verify them before installation.
- Avoid
npxresolution of an unspecified package version. Pin the CLI package itself and use a lockfile where applicable. - Replace unconditional periodic reinstallation with a controlled update process that displays and reviews changes before activation.
- Download dependencies into a staging location and inspect their manifests, instructions, and executable content before installation.
- Run installation with a non-privileged account in a sandbox that has no unnecessary filesystem, credential, wallet, or network access.
- Maintain an allowlist of approved package sources, versions, hashes, and expected signing identities.
- Document a rollback procedure and preserve the last verified dependency version.
- Keep the existing prohibition against placing account secrets, private keys, mnemonics, signatures, or payment headers in prompts and logs.