T08 · Insecure Dependencies
Warning
- Location
SKILL.md:90- Finding
Unpinned, Non-Interactive Installation of Third-Party Skills
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:90-98, 114-124, 138
Vulnerability Type: Supply-chain exposure through mutable, unpinned external skill sources
Risk Level: MediumComplete Code Snippet
markdown ### 5. Decide Whether to Install Automatically Install without asking an extra question only when all are true: - The user asked to automatically install, or the agent needs the skill to complete the current task. - One candidate is clearly best. - The source is trusted enough for the task. - The installation command will not perform surprising writes outside the normal skills directory. Otherwise present a short ranked list with a recommendation and wait for the user's choice. ### 6. Install Use the installer that matches the source: ```bash # OpenClaw: ClawHub slug into active workspace openclaw skills install <slug> # OpenClaw: local skill directory into active workspace openclaw skills install /path/to/skill --as <slug> # OpenClaw: shared managed install visible to all local agents openclaw skills install /path/to/skill --as <slug> --global # OpenClaw: git source openclaw skills install git:<owner>/<repo>@<ref> --as <slug> # Hermes: registry/GitHub/URL skill hermes skills install <identifier> --yes # skills.sh / agent skills package npx skills find "react performance" npx skills add <owner/repo@skill> -g -y # OpenAI curated or experimental skill paths python3 /path/to/skill-installer/scripts/install-skill-from-github.py --repo openai/skills --path skills/.curated/<skill-name>Hermes notes:
hermes skills installaccepts registry identifiers and direct HTTP(S) URLs toSKILL.md.
text ### Technical Analysis The workflow permits an agent to discover and install third-party skills automatically. The documented examples use non-interactive flags such as `--yes` and `-y`, permit global installation, and accept registry identifiers, repository references ...[truncated 2469 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user approval before every external installation, particularly global installations and sources outside curated registries.
- Resolve repositories and packages to immutable commit hashes or fixed versions. Do not install from mutable branches, floating tags, unversioned registry names, or unrestricted direct URLs.
- Require cryptographic verification through trusted signatures or published checksums. Fail closed when verification data is unavailable or mismatched.
- Download candidates into an isolated quarantine directory before installation. Review
SKILL.md, scripts, manifests, hooks, and transitive dependencies before moving content into an active skill directory. - Maintain allowlists for trusted registries, organizations, repositories, and HTTPS domains. Reject redirects or sources outside the allowlist.
- Remove unattended
--yesand-ydefaults from generic examples. Make non-interactive installation available only for preapproved sources pinned to verified immutable artifacts. - Default to workspace-scoped installation. Require separate confirmation for
--globalbecause it expands exposure to other agents and future sessions. - Execute verification and installation with least privilege, restricted network access, and filesystem writes limited to a staging directory and the intended skill destination.
- Record the source URL, resolved commit or version, digest, review result, destination, and installation time to support later auditing and revocation.
- Revalidate the exact downloaded artifact after retrieval rather than relying solely on metadata observed during discovery.