T08 · Insecure Dependencies
- Location
SKILL.md:29- Finding
Unverified Execution of Mutable External Skills
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29-69 and 91-95
Vulnerability Type: Untrusted local skill dependency execution
Risk Level: MediumVulnerable Skill Instructions
The following is an English translation of the relevant instruction segments:
text Read the skill file: C:\Users\admin\.qclaw\workspace\skills\post-kuaishou-short-videos-infinite\SKILL.md Execute the complete workflow described by that skill document. After Kuaishou publishing has fully completed, read the skill file: C:\Users\admin\.qclaw\workspace\skills\post-tiktok-short-videos-infinite\SKILL.md Execute the complete workflow described by that skill document. After Douyin publishing has fully completed, read the skill file: C:\Users\admin\.qclaw\workspace\skills\publish-xhs-short-videos-infinite\SKILL.md Execute the complete workflow described by that skill document.The dependency paths are repeated at lines 91-95:
text Kuaishou skill: C:\Users\admin\.qclaw\workspace\skills\post-kuaishou-short-videos-infinite\SKILL.md Douyin skill: C:\Users\admin\.qclaw\workspace\skills\post-tiktok-short-videos-infinite\SKILL.md Xiaohongshu skill: C:\Users\admin\.qclaw\workspace\skills\publish-xhs-short-videos-infinite\SKILL.mdTechnical Analysis
The audited skill unconditionally delegates its behavior to three external skill documents stored at mutable absolute paths outside the project. None of those dependency files are included in the audited artifact, and the orchestrator does not verify their origin, version, integrity, ownership, or contents before directing the Agent to execute their complete workflows.
This creates an unsafe dependency boundary. A party capable of creating or modifying any referenced file can change the effective behavior after this parent skill has been reviewed. Because the child skills execute through an authenticated browser and are expected to upload content, ...[truncated 1896 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the reviewed child skills inside the project rather than loading mutable files from external absolute paths.
- Pin every child skill to an immutable version and verify a cryptographic digest or trusted signature before loading it.
- Resolve dependencies through an approved registry or allowlist instead of user-specific filesystem paths.
- Reject missing dependencies, path substitutions, symbolic-link redirection, unexpected ownership, and integrity mismatches.
- Do not authorize execution of an entire child document without restriction. Define and enforce the exact tools, domains, files, and browser actions each child skill may use.
- Require explicit user confirmation immediately before any irreversible publication, deletion, account-setting change, or transmission of sensitive data.
- Run delegated skills with least privilege and isolate their browser sessions and filesystem access where practical.
- Record the verified dependency identity, version, digest, requested actions, and publication result in an audit log.
- Include all child skills in future security reviews so the effective end-to-end workflow can be assessed.