T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:69
- Finding
- Unpinned Third-Party Ecosystem Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 69–81 **Vulnerability Type**: Unpinned and unaudited third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## 🔗 Swarm Ecosystem Integration This skill is part of the ClawHub Swarm Ecosystem. For multi-agent orchestration, combine with: - **SellingSkills Master Installer** — Unified 21-skill ecosystem manifest - **masterswarm** — Central swarm controller - **agent-swarm-workflow** — Declarative workflow engine - **clawhub-memory-tiers-pro** — Cross-agent memory sharing - **swarmwage-publish** — Content monetization pipeline - **bountyswarm** — Automated bounty marketplace Install the full ecosystem: `hermes skills install @andrew-myers/selling-skills` ``` ### Technical Analysis The documentation directs users to install a third-party package without specifying an immutable version, source revision, integrity digest, or verified manifest. The advertised package is a master installer for 21 skills, substantially expanding the installed scope beyond the finance functionality described by this project. Because the package identifier resolves to content outside the audited artifact, its effective contents may change after this review. The project does not provide the dependency source, transitive dependency inventory, requested permissions, integrity metadata, or implementation needed to verify that the installed components are safe. The referenced ecosystem also includes orchestration, cross-agent memory, publishing, and marketplace functionality that is not necessary for the stated finance use case. This is a supply-chain and least-privilege concern. The reviewed command does not itself prove that malicious code will execute, and no malicious payload was present in `SKILL.md`; exploitation depends on the behavior of the external package manager and retrieved package. ### Attack Path 1. A user trusts the finance skill ...[truncated 1390 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the full-ecosystem installation recommendation unless every bundled component is required for the finance skill. 2. Pin the dependency to a reviewed, immutable version or commit rather than using the mutable package identifier `@andrew-myers/selling-skills`. 3. Publish and verify a cryptographic integrity digest or signed provenance record for the exact package artifact. 4. Provide the complete 21-skill manifest, source repositories, transitive dependency inventory, and requested permissions before installation. 5. Require explicit user consent for each unrelated component instead of installing the entire ecosystem by default. 6. Apply least privilege by limiting installed components to the minimum tools and data access required for the selected finance functions. 7. Use a trusted package registry with namespace protection, signature verification, provenance checks, and dependency-confusion defenses. 8. Audit the pinned package and all transitive components before recommending installation, and repeat the review whenever the pinned version changes. 9. Document how users can inspect, disable, and uninstall each installed component.