T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:46
- Finding
- Unpinned External Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 46-67 **Vulnerability Type**: Unpinned and mutable external skill dependencies **Risk Level**: Medium The skill recommends installing externally maintained ClawHub skills by slug without pinning an immutable version, digest, or trusted signature. ### Vulnerable Code ```markdown ## Install Commands Install the current AgentPMT setup skills: | Skill | AgentPMT ClawHub Page | Install Command | |---|---|---| | AgentPMT no-account AgentAddress/x402 setup | https://clawhub.ai/agentpmt/agentpmt-no-account-agentaddress-x402 | `openclaw skills install agentpmt-no-account-agentaddress-x402` | | What Is AgentPMT | https://clawhub.ai/agentpmt/what-is-agentpmt | `openclaw skills install what-is-agentpmt` | | AgentPMT account MCP/REST API setup | https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup | `openclaw skills install agentpmt-account-mcp-rest-api-setup` | ```bash openclaw skills install agentpmt-no-account-agentaddress-x402 openclaw skills install what-is-agentpmt openclaw skills install agentpmt-account-mcp-rest-api-setup ``` Install the current AgentPMT product skill published on the org account: | Skill | AgentPMT ClawHub Page | Install Command | |---|---|---| | Image Generation Agent | https://clawhub.ai/agentpmt/image-generation-agent | `openclaw skills install image-generation-agent` | ```bash openclaw skills install image-generation-agent ``` ``` ### Technical Analysis Although the document lists expected versions elsewhere, the installation commands contain only package slugs. They do not pin versions or content digests and do not require cryptographic signature verification. Consequently, the artifacts resolved at installation time may differ from the versions represented in this audited index. The referenced skills are not included in this project, so their instructions, scripts, dependencies, and runtime behavior cou ...[truncated 1323 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every external skill to an exact immutable version and, where supported, a cryptographic content digest. 2. Require signature verification against an explicitly trusted publisher identity before installation. 3. Fail closed if the resolved version, digest, signature, or publisher differs from the documented value. 4. Display the resolved artifact identity and obtain explicit user confirmation before installation. 5. Audit each referenced skill, including its scripts and transitive dependencies, before approving it for use. 6. Retain a reviewed lock file or trusted manifest containing the approved slug, version, digest, and publisher identity. 7. Install and run external skills with least privilege, restricting filesystem, credential, tool, and network access to what each skill requires.