T08 · Insecure Dependencies
Error
- Location
scripts/check-assessment.sh:50- Finding
Automatic Installation of an Unpinned External Skill Dependency
- Content
View full analysis
/dev/null; then echo "📦 Attempting to install via clawhub..." if clawhub install botlearn-assessment; then echo "✅ botlearn-assessment installed successfully" exit 0 else echo "❌ clawhub install failed" exit 2 fi ``` The corresponding setup instruction is: ```markdown If this is your first time running this skill, execute `bash scripts/check-assessment.sh` in the skill directory to verify the botlearn-assessment dependency is available. ``` ### Technical Analysis The script is presented as a dependency availability check, but it changes the environment by automatically executing: ```bash clawhub install botlearn-assessment ``` The dependency is not pinned to a reviewed version, checksum, immutable package digest, or verified publisher identity. The script also does not request explicit user confirmation before installation. Consequently, the effective behavior of the project can change after this project itself has been audited. This creates a supply-chain trust boundary: the security of the certification Skill depends on whichever package the external registry resolves under `botlearn-assessment` at installation time. A compromised registry account, malicious replacement release, or unexpectedly changed dependency could introduce hostile Skill instructions or executable scripts. ### Attack Path 1. The user runs the documented first-time setup command. 2. `check-assessment.sh` fails to find a local `botlearn-assessment` installation. 3. The script detects the `clawhub` executable. 4. Without requesting confi ...[truncated 1105 chars]- Remediation
View remediation
&2 echo "Review and install the pinned dependency explicitly." >&2 exit 1 ``` ]]>