Okf Knowledge Format

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent documentation for working with OKF files, but it tells users to install an unpinned tool directly from a mutable GitHub repository.

Review the referenced okf-toolkit repository before installing, prefer a pinned commit or verified release, and install it in a virtual environment or container without administrator privileges or unnecessary access to sensitive files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:97

Finding

Unpinned Third-Party VCS Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 97
Vulnerability Type: Unpinned dependency installed from a mutable remote Git repository
Risk Level: Medium

Vulnerable Code

markdown

- Install: `pip install git+https://github.com/akdira/okf-toolkit.git`

Technical Analysis

The documented command instructs users or agents to install Python code directly from the default branch of a third-party GitHub repository. It specifies neither a reviewed release version nor an immutable commit hash. Consequently, the code retrieved by the same command can change after the skill has been audited.

Python package installation can execute dependency-controlled build or installation logic. Trusting a mutable remote branch therefore creates a supply-chain risk: compromise of the repository, its maintainer account, or its ownership could turn this instruction into an arbitrary-code-execution vector.

The referenced repository is also hosted under an individual account rather than the Google Cloud organization associated with the specification mentioned elsewhere in the document. This does not establish maliciousness, but it increases the importance of immutable version pinning and independent provenance verification.

Attack Path

1. An attacker compromises the repository, its maintainer account, or another mechanism capable of changing its default branch.
2. The attacker adds malicious package build, installation, or runtime code.
3. A user or agent follows the installation command in SKILL.md.
4. pip retrieves the repository’s current mutable revision rather than the revision originally reviewed.
5. Malicious package-controlled code executes during installation or subsequent CLI use.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running pip. Depending on those privileges and the local environment, the malicious dependency could access user-readable files, cre ...[truncated 348 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable-branch installation command with an exact, reviewed release version from a trusted package registry where possible.
2. If installation from Git is necessary, pin the URL to a full immutable commit hash, for example:

   bash

   pip install "git+https://github.com/akdira/okf-toolkit.git@FULL_REVIEWED_COMMIT_HASH"
   

3. Record and verify the expected source revision and package provenance before installation.
4. Use a lock file or requirements file with cryptographic hashes where the distribution mechanism supports it, and enforce installation with pip --require-hashes.
5. Review the dependency’s package metadata, build configuration, transitive dependencies, and relevant source code before approving a pinned revision.
6. Install the tool in an isolated virtual environment or container under a non-privileged account.
7. Avoid administrator or root installation and restrict access to credentials, sensitive files, and unnecessary network resources during installation and execution.

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 96% confidence

Finding

The skill instructs users to install a package directly from a GitHub repository using pip install git+https://..., which pulls and executes unpinned code from a remote source during installation. In an agent-skill context, this is especially risky because it normalizes fetching and running external code outside a vetted package registry, enabling supply-chain compromise, repository takeover, or malicious code execution if the repo changes.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

8. Validate before committing

## Error Tolerance

OKF consumers MUST tolerate unknown frontmatter keys. If you encounter a field you don't recognize, skip it rather than failing.

## Resources

- OKF Spec: https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/main/okf/SPEC.md
- okf-toolkit: https://github.com/akdira/okf-toolkit
- Project home: [akdira](https://www.akdira.id)
- Install: `pip install git+https://github.com/akdira/okf-toolkit.git`

---

*Created by [akdira](https://www.akdira.id).*

Static analysis

No suspicious patterns detected.