T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Remote Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 31 **Vulnerability Type**: Unpinned installation from a mutable remote Git repository **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🔍","os":["darwin","linux"],"requires":{"bins":["qmd"]},"install":[{"id":"bun-qmd","kind":"shell","command":"bun install -g https://github.com/tobi/qmd","bins":["qmd"],"label":"Install qmd via Bun"}]}} ``` ```bash bun install -g https://github.com/tobi/qmd ``` ### Technical Analysis The installation command retrieves and globally installs QMD directly from a mutable GitHub repository reference. It does not identify an immutable release, tag, or commit hash and provides no integrity or provenance verification. Consequently, the code executed during installation can change after this skill has been reviewed without requiring any modification to the skill itself. Bun may also process package installation or lifecycle behavior supplied by the remote project. Such behavior executes with the permissions of the user running the installation. This is a supply-chain weakness rather than evidence that the current upstream project is malicious. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or a relevant upstream dependency. 2. The attacker modifies the repository content or package lifecycle behavior reached by the mutable installation reference. 3. A user or agent follows the skill metadata or documented installation command. 4. Bun downloads the changed remote content and performs the global installation. 5. Attacker-controlled code executes with the installing user's privileges. 6. The payload can access resources available to that account, including user-readable files and Markdown collections intended for later indexing. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. The attacker could read or modify user-a ...[truncated 364 chars]
- Remediation
- ## Remediation Suggestions - Replace the mutable repository installation target with a reviewed, immutable release or full commit hash. - Pin all transitive dependencies to reviewed versions through an appropriate lockfile. - Require integrity hashes or cryptographic signature verification where supported. - Verify package provenance and release ownership before installation. - Disable package lifecycle scripts when they are unnecessary and the package manager supports doing so. - Avoid elevated privileges during installation and execution. - Document the exact reviewed QMD version and establish a controlled process for reviewing and approving upgrades.