T08 · Insecure Dependencies
Error
- Location
- SKILL.md:8
- Finding
- Execution Delegated to Unavailable and Unverified External Project Content## Vulnerability Details **File Location**: `SKILL.md`, lines 8-12 **Vulnerability Type**: Unverified external implementation dependency **Risk Level**: High **Complete Code Snippet**: ```markdown > Deprecated wrapper: maintained implementation lives in `skills/codex-profiler/`. For `/codex_usage*` requests, follow `../codex-profiler/SKILL.md` and run: ```bash python3 skills/codex-profiler/scripts/codex_usage.py --profile all --format text ``` ``` ### Technical Analysis The audited skill delegates both instruction processing and local code execution to a separate `codex-profiler` component that is not included in the audited project. Consequently, the security properties of the effective behavior cannot be established from this package. The dependency is neither version-pinned nor protected by an integrity check. If content at the referenced location is mutable or attacker-controlled, it can replace the expected instructions or Python implementation after this wrapper has been reviewed. The documentation reference (`../codex-profiler/SKILL.md`) and executable reference (`skills/codex-profiler/scripts/codex_usage.py`) also use different relative path bases, increasing the possibility of resolving an unintended component. ### Attack Path 1. An attacker gains the ability to create or modify the `codex-profiler` content at either path resolved by the host environment. 2. The attacker replaces `SKILL.md` with hostile agent instructions, replaces `codex_usage.py` with arbitrary Python code, or both. 3. A user submits a supported `/codex_usage*` request. 4. This wrapper instructs the agent to follow the external skill instructions and execute the external Python script. 5. The substituted content executes with the permissions available to the agent or Python process. ### Impact Assessment Successful exploitation could permit arbitrary local code execution within the invoking process's privilege boundary. Depending ...[truncated 434 chars]
- Remediation
- ## Remediation Suggestions - Bundle the required implementation within the audited project so its instructions and executable code can be reviewed together. - If an external component is required, pin it to an immutable, trusted version and verify a cryptographic hash or signature before use. - Resolve the dependency through one canonical absolute path rather than using inconsistent relative paths. - Validate the dependency's ownership and permissions and reject files writable by untrusted users. - Do not automatically load external skill instructions. Define the wrapper's complete behavior locally and invoke only a narrowly scoped, verified executable. - Fail closed when the expected implementation is missing or fails integrity validation.