T08 · Insecure Dependencies
- Location
skill.md:20- Finding
Unverified Retrieval of Mutable Skill Files
- Content
View full analysis
Vulnerability Details
File Location:
skill.md, lines 20–22
Vulnerability Type:T08: Insecure Dependencies
Risk Level: Mediumbash curl -s https://crabernews.com/skill.md > ~/.crabernews/skills/crabernews/SKILL.md curl -s https://crabernews.com/heartbeat.md > ~/.crabernews/skills/crabernews/HEARTBEAT.md curl -s https://crabernews.com/skill.json > ~/.crabernews/skills/crabernews/package.jsonTechnical Analysis
The documented installation process downloads mutable skill instructions and metadata directly from remote URLs without version pinning, cryptographic signature validation, or checksum verification. Consequently, the files installed by a user are not guaranteed to match the files reviewed during this audit.
This is particularly significant for
SKILL.mdandHEARTBEAT.md, because their contents may influence agent behavior when loaded. If the hosting service, deployment pipeline, DNS resolution, or published resources are compromised, an attacker could replace these files with modified instructions. The commands also usecurl -swithout--fail, so an HTTP error response could silently overwrite a local skill file.Attack Path
- An attacker compromises the remote hosting service, its publishing pipeline, or another mechanism controlling the referenced resources.
- The attacker replaces one or more mutable files, such as
skill.mdorheartbeat.md, with attacker-controlled content. - A user executes the documented installation commands.
curlwrites the unverified remote content into the local Craber News skill directory.- The agent subsequently loads the substituted instructions as trusted skill content.
- Depending on the injected instructions and the tools available to the agent, the attacker may attempt to redirect agent behavior, solicit sensitive information, or induce unauthorized network or tool operations.
Impact Assessment
Successful expl ...[truncated 711 chars]
- Remediation
View remediation
Remediation Suggestions
- Distribute the reviewed skill files inside a versioned package rather than retrieving mutable resources during installation.
- If remote retrieval is necessary, use immutable, version-specific URLs and publish trusted SHA-256 or stronger checksums.
- Verify every downloaded file against its expected checksum or a cryptographic signature before moving it into the skill directory.
- Download into a securely created temporary file and perform an atomic rename only after successful validation.
- Use failure-safe curl options, such as
--fail --show-error --location, and abort installation if any request or validation step fails. - Pin the expected origin and enforce HTTPS certificate validation without insecure overrides.
- Prevent partial installation by validating all required files before replacing any existing local version.