T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:39
- Finding
- Mandatory Retrieval and Execution of Unpinned Remote Skills<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–85 **Vulnerability Type**: Remote dependency retrieval and execution **Risk Level**: High ### Complete Code Snippet ```text This skill works with the following website-building and optimization skills. The relevant skills are provided through third-party SkillHub publication addresses and must be installed and loaded according to the dependency installation protocol. These dependencies are not automatically preinstalled. They must be actively installed before they can be invoked; do not assume they already exist. Dependencies: - Website Builder: https://skillhub.cn/skills/org-b0bh4w8c/jian-zhan - SEO Skill: https://skillhub.cn/skills/org-b0bh4w8c/seo-skill - GEO Skill: https://skillhub.cn/skills/org-b0bh4w8c/geo-tools Dependency loading procedure: 1. Determine whether the dependency is already loaded. 2. If it is unavailable or uncertain, obtain the skill package from the corresponding third-party SkillHub publication address. 3. Use the current agent's loading or import mechanism to register the skill package as an available skill. 4. Confirm that the skill can be invoked and record its real name. 5. Use the registered name for all subsequent Skill calls. ``` ### Technical Analysis The skill explicitly requires the agent to retrieve and load three executable instruction packages from mutable third-party URLs. No immutable package version, commit identifier, cryptographic checksum, publisher signature, or trusted-key verification is specified. The workflow only verifies that a downloaded skill can be loaded and invoked. It does not require the agent to compare the package against audited content or review the complete package before granting it capabilities. Consequently, the effective instructions executed at runtime can change after this project has been reviewed. This is especially dangerous because the remote website-builder dependency is later invoked while the a ...[truncated 2076 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor reviewed copies of all required skills into the project rather than downloading mutable packages at runtime. 2. Pin every dependency to an immutable release identifier and cryptographic digest. 3. Require signature verification against explicitly trusted publisher keys before loading any package. 4. Fail closed if a package digest, signature, publisher identity, or expected manifest does not match. 5. Review the complete dependency package, including scripts and referenced files, before registering it. 6. Record verified package versions and digests in the dependency installation report. 7. Apply a capability allowlist to each dependency. The SEO and GEO dependencies should not receive write privileges if they only need read access. 8. Keep bearer credentials outside dependency-visible prompts and pass narrowly scoped operations through a trusted broker. 9. Use separate, short-lived credentials for content import, page generation, and publication. 10. Require explicit approval for high-impact operations even when requested by a loaded dependency. ]]>