T08 · Insecure Dependencies
- Location
SKILL.md:141- Finding
Unpinned and Unverified Remote Design Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 141–147
Vulnerability Type: Untrusted supply-chain content retrieval
Risk Level: Mediumbash # Auto-download from awesome-design-md curl https://raw.githubusercontent.com/VoltAgent/awesome-design-md/main/design-md/{brand}/DESIGN.md # Save to project mkdir -p Docs/Design cp downloaded.md Docs/Design/{brand}-DESIGN.mdTechnical Analysis
The skill instructs the agent to retrieve a design specification from the mutable
mainbranch of an external GitHub repository. It does not pin the resource to a reviewed commit, verify a checksum or signature, or validate the downloaded content before using it as an agent-facing design reference.Consequently, the effective design instructions can change after the skill has been audited. If the upstream repository, maintainer account, or delivery path is compromised, hostile Markdown could be supplied and interpreted by an AI agent as operational instructions rather than inert design data.
The example also invokes
curlwithout an output option but subsequently copiesdownloaded.md. As written, the response is sent to standard output and does not create that file. If a pre-existingdownloaded.mdis present, the workflow may copy stale or attacker-controlled local content instead.The
{brand}placeholder should also be constrained to the documented brand allowlist before being included in URLs or filesystem paths. Although no direct user-to-shell interpolation implementation is present in the audited file, explicit validation would prevent unsafe implementations from introducing path or command injection.Attack Path
- An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying content on the referenced
mainbranch. - The attacker modifies a brand's
DESIGN.mdto contain misleading or hostile instructions. - The skill fetches the mutab ...[truncated 1199 chars]
- An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying content on the referenced
- Remediation
View remediation
Remediation Suggestions
-
Pin the remote resource to a reviewed immutable Git commit rather than
main. -
Publish an expected SHA-256 digest and verify the downloaded file before use.
-
Download explicitly and fail safely, for example:
bash set -euo pipefail readonly BRAND="vercel" readonly COMMIT="REVIEWED_COMMIT_HASH" readonly EXPECTED_SHA256="EXPECTED_SHA256_DIGEST" case "$BRAND" in vercel|linear|cursor|raycast|supabase|claude|cohere|mistral|mintlify|notion|stripe|apple|framer) ;; *) echo "Unsupported brand" >&2; exit 1 ;; esac mkdir -p Docs/Design tmp_file="$(mktemp)" trap 'rm -f "$tmp_file"' EXIT curl --fail --silent --show-error --location \ --output "$tmp_file" \ "https://raw.githubusercontent.com/VoltAgent/awesome-design-md/${COMMIT}/design-md/${BRAND}/DESIGN.md" printf '%s %s\n' "$EXPECTED_SHA256" "$tmp_file" | sha256sum --check - install -m 0644 "$tmp_file" "Docs/Design/${BRAND}-DESIGN.md" -
Treat downloaded Markdown as untrusted reference data. Explicitly instruct the consuming agent not to follow commands, tool requests, role changes, or safety-policy modifications embedded in it.
-
Validate the document against an expected schema or extract only approved design-token fields instead of feeding the entire document into the agent context.
-
Review upstream changes before updating the pinned commit and checksum.
-
Remove the ambiguous
cp downloaded.mdworkflow so stale files cannot be substituted for the actual response.
-