T08 · Insecure Dependencies
Warning
- Location
README.md:25- Finding
Unpinned Installation from a Mutable Personal Repository
- Content
View full analysis
Vulnerability Details
File Location:
README.md, lines 25–28
Vulnerability Type: Untrusted and mutable supply-chain source
Risk Level: MediumVulnerable Code
bash Or clone directly: ```bash git clone https://github.com/djanngau/hongkong-immigration-skill.git \ ~/.codex/skills/hongkong-immigrationtext ### Technical Analysis The documented installation procedure clones the default branch of a personal GitHub repository directly into the active Codex skills directory. It does not pin an immutable commit or signed release, nor does it require checksum or signature verification. Consequently, the installed content may differ from the version reviewed in this audit. A subsequent repository modification or compromise of the repository owner's account could introduce hostile skill instructions or executable files without changing the documented installation command. The audited artifact itself contains no malicious payload. The vulnerability is the unsafe trust model of the documented installation mechanism. ### Attack Path 1. An attacker compromises the upstream repository, its owner account, or another credential capable of changing its default branch. 2. The attacker adds malicious instructions to `SKILL.md` or adds scripts that perform unauthorized actions when invoked. 3. A user follows the README and clones the mutable default branch directly into `~/.codex/skills/hongkong-immigration`. 4. The agent discovers and loads the attacker-controlled skill content from its active skills directory. 5. The malicious instructions or scripts execute within the permissions available to the agent process. ### Impact Assessment Successful exploitation can provide control over the installed skill's instructions and behavior. The resulting scope is bounded by the tools, filesystem access, network access, credentials, and operating-system privileges available to the agent process. Potential consequences include agent instruction manipulat ...[truncated 243 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the default-branch clone instructions with an immutable, reviewed commit or versioned release:
bash git clone https://github.com/djanngau/hongkong-immigration-skill.git cd hongkong-immigration-skill git checkout --detach <reviewed-commit-sha>- Publish SHA-256 checksums for release archives and require users to verify them before installation.
- Sign release tags or artifacts and document signature verification.
- Prefer immutable, versioned releases from a verified package registry over direct installation from a mutable branch.
- Download and verify the skill in a staging directory before copying it into the active skills directory.
- Require review of
SKILL.md, executable files, and installation hooks before activation. - Protect the upstream repository with multi-factor authentication, branch protection, restricted release permissions, and mandatory review.