T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:85
- Finding
- Unpinned Third-Party Skill Retrieval and Global Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 85-112 **Vulnerability Type**: Unreviewed and unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add <owner/repo@skill> -g -y ``` The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts. **For clawhub skills:** ```bash clawhub install <slug> ``` Optionally specify version: ```bash clawhub install <slug> --version <version> ``` **For tessl.io skills:** ```bash tessl install <skill-name> ``` Install from GitHub: ```bash tessl install github:user/repo ``` ### Technical Analysis The skill instructs the agent to retrieve and install third-party skills without requiring an immutable version, commit hash, integrity digest, signature verification, or pre-installation review. The default `skills.sh` command combines global installation with `-y`, bypassing the confirmation prompt. Related instructions elsewhere in `SKILL.md` also recommend executing `npx skills` and globally installing the `clawhub` and `tessl` command-line packages without pinning package versions. Because registry packages, tags, slugs, and repositories can change after this skill has been reviewed, the effective installed content is not fixed by the audited document. This is a supply-chain weakness rather than evidence that any named registry is malicious. Exploitation depends on a malicious or compromised package, repository, publisher account, registry entry, or deceptively named dependency being selected for installation. ### Attack Path 1. An attacker publishes a malicious skill or compromises an existing skill, repository, publisher account, or registry entry. 2. The malicious entry is returned by a registry search and appears relevant to a user's request. 3. The agent recommends or runs an installation command using a mutable slug, package name, tag, ...[truncated 1049 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval before every installation and remove `-y` from the default command. 2. Prefer project-local, isolated installation over global installation. Use `-g` only when the user specifically requests it and understands its scope. 3. Pin command-line packages and skills to reviewed versions. For GitHub sources, prefer immutable commit hashes rather than mutable branches or tags. 4. Verify publisher identity, source repository, release signatures, checksums, and package integrity metadata before installation. 5. Download and inspect each skill's instructions, scripts, manifests, lifecycle hooks, and dependency tree before enabling it. 6. Display the exact registry, source URL, resolved version or commit, requested permissions, and final command to the user before execution. 7. Where supported, disable package lifecycle scripts during initial retrieval and perform installation in a sandbox with restricted filesystem, credential, and network access. 8. Maintain an allowlist of trusted publishers and reviewed skill versions, and re-review dependencies before updates. 9. Update the documented examples to use immutable placeholders, such as a verified semantic version or commit hash, rather than an unqualified slug or repository reference.