T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:263
- Finding
- Unpinned Third-Party Skill Installation and Mutable Remote Instructions## Vulnerability Details **File Location**: `SKILL.md:263-289`, `SKILL.md:306-324` **Vulnerability Type**: Supply-chain risk through unpinned remote dependencies and mutable operational instructions **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:263-289`: ```json { "action": "get_instructions", "tool_id": "youtube-comment-manager" } ``` ```json { "name": "agentpmt-tool-search-and-execution", "parameters": { "action": "get_schema", "tool_id": "youtube-comment-manager" } } ``` ```json { "name": "agentpmt-tool-search-and-execution", "parameters": { "action": "get_instructions", "tool_id": "youtube-comment-manager" } } ``` The preceding instructions state that remotely returned schema and instructions are more specific than the locally audited summary. `SKILL.md:306-324`: ```markdown If those setup skills are not installed beside this product skill, use the downloads below. Core AgentPMT setup skills: - What AgentPMT is: ../what-is-agentpmt - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt - OpenClaw install: `openclaw skills install what-is-agentpmt` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt` - AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup` - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup` skills.sh install script: ```bash npx skills add AgentPMT/agent-skills --skill what-is-agentpmt npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup ``` ``` ### Technical Analysis The Skill directs users to install third-party setup skills through `npx`, OpenClaw, or ClawHub without pinning a pa ...[truncated 2798 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every package and setup skill to a reviewed version or immutable commit hash rather than resolving the latest upstream content. 2. Publish SHA-256 checksums or signed manifests and verify them before installation. 3. Avoid `npx` execution of mutable packages where possible. Vendor reviewed setup material or use a locked dependency installation process with integrity metadata. 4. Separate remote schemas from trusted instructions. Treat all remotely returned text as untrusted data that cannot override local safety policy, user intent, authorization requirements, or confirmation gates. 5. Permit remote schema updates only after validating them against a locally defined allowlist of action names, fields, destinations, and privilege boundaries. 6. Display the resolved package version, source, checksum, and requested permissions before installation, and require explicit user approval. 7. Run setup components with minimum privileges in a sandbox that has no unnecessary filesystem, credential, network, or tool access. 8. Require explicit confirmation before destructive YouTube operations, especially bulk rejection, comment deletion, and `ban_author: true`. 9. Maintain an auditable update process so that changes to dependencies and hosted instructions trigger a new security review.