T08 · Insecure Dependencies
- Location
SKILL.md:45- Finding
Unpinned and Unverified Skill Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 45-49
Vulnerability Type: Supply-chain dependency confusion and name squatting
Risk Level: MediumVulnerable Code Snippet
markdown ### Skills It Installs - ai-memory-system - ai-safety-rails - launch-blitz - nowpayments-integrationTechnical Analysis
The setup documentation states that four additional skills are installed, but identifies them only by mutable, unqualified names. It provides no authoritative registry, repository URL, publisher identity, immutable commit hash, pinned version, checksum, digital signature, permission manifest, or review procedure.
An AI agent following these instructions may search for and install a package based solely on its name. This creates exposure to dependency confusion, name squatting, account compromise, and malicious updates. The risk is particularly significant because the named components relate to persistent memory, agent safety controls, external publishing, and payment integration.
The reviewed project itself contains no executable scripts, package dependencies, install hooks, or demonstrated malicious payload. The vulnerability is therefore the unsafe dependency-resolution instruction rather than confirmed execution of malicious code.
Attack Path
- An attacker publishes or gains control of a skill matching one of the documented names.
- A user asks an AI agent to run the documented company-builder setup.
- The agent resolves the dependency by its unqualified name because no trusted source or immutable version is specified.
- The agent installs or follows the attacker-controlled skill using its available filesystem, API, or operational permissions.
- The malicious dependency can then attempt to alter memory or safety configuration, obtain accessible payment credentials, publish unauthorized content, or perform other actions allowed by the agent's permissions.
Impact Ass
...[truncated 521 chars]
- Remediation
View remediation
Remediation Suggestions
- Identify every dependency with an authoritative HTTPS repository and verified publisher.
- Pin each skill to an immutable commit hash or a signed, exact release version.
- Publish and verify cryptographic checksums or signatures before installation.
- Define a permission manifest for every dependency and grant only the minimum required access.
- Inspect dependency contents and transitive dependencies before execution.
- Disable automatic discovery or installation based solely on package names.
- Require explicit human approval before configuring payment services, reading secrets, modifying persistent memory, or publishing to external platforms.
- Maintain an allowlist of reviewed sources and document a controlled update and re-audit process.