T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:42
- Finding
- Unpinned Remote Skill Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:42-62` **Vulnerability Type**: Unpinned third-party skill dependencies **Risk Level**: Medium ```markdown | Skill | AgentPMT ClawHub Page | Install Command | |---|---|---| | AgentPMT no-account AgentAddress/x402 setup | https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402 | `openclaw skills install agentpmt-no-account-agentaddress-x402` | | What Is AgentPMT | https://clawhub.ai/agentpmt/what-is-agentpmt | `openclaw skills install what-is-agentpmt` | | AgentPMT account MCP/REST API setup | https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup | `openclaw skills install agentpmt-account-mcp-rest-api-setup` | ```bash openclaw skills install agentpmt-no-account-agentaddress-x402 openclaw skills install what-is-agentpmt openclaw skills install agentpmt-account-mcp-rest-api-setup ``` Install the current AgentPMT product skill published on the org account: | Skill | AgentPMT ClawHub Page | Install Command | |---|---|---| | Image Generation Agent | https://clawhub.ai/agentpmt/image-generation-agent | `openclaw skills install image-generation-agent` | ```bash openclaw skills install image-generation-agent ``` ``` ### Technical Analysis The documented commands install third-party skills using mutable slugs without specifying immutable versions or artifact digests. Although `SKILL.md` lists expected versions and canonical publisher pages elsewhere, the installation commands do not enforce those versions or verify the integrity of the retrieved artifacts. Consequently, the effective content installed by these commands can differ from the content that existed when this index was reviewed. The referenced remote skill packages are not included in the audited project, so their instructions, scripts, permissions, and runtime behavior could not be assessed. A compromised publisher account, malicious future release, registry-resolution failure, or ...[truncated 1565 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to an exact immutable version in each installation command, where supported. 2. Prefer cryptographic artifact digests or signed release identifiers over version labels alone. 3. Use fully qualified publisher and package identifiers to reduce ambiguity in registry resolution. 4. Verify publisher signatures, checksums, and package provenance before installation. 5. Retrieve and review each remote skill's instructions, scripts, declared permissions, network behavior, and transitive dependencies before activation. 6. Execute newly installed skills in a least-privilege sandbox with restricted filesystem, credential, network, and tool access. 7. Maintain an approved lockfile or allowlist recording the exact reviewed artifact for each skill. 8. Fail closed if the requested immutable release is unavailable or if integrity verification fails; do not silently install the latest release. 9. Update the documented commands so the versions shown in the catalog are actually enforced during installation.