T08 · Insecure Dependencies
Warning
- Location
install.sh:5- Finding
Unpinned Remote Skill Installation from a Mutable Repository Branch
- Content
View full analysis
/dev/null mkdir -p "$SKILL_DIR" cp "$TMPDIR/nobodybuilt/SKILL.md" "$SKILL_DIR/nobodybuilt.md" ``` `README.md:76-81`: ```bash # One-liner — clone and install git clone https://github.com/KeWang0622/nobodybuilt.git && cp nobodybuilt/SKILL.md ~/.claude/skills/nobodybuilt.md ``` ### Technical Analysis The installation procedures clone the current default branch of a remote GitHub repository without pinning a reviewed commit or release. They do not verify a checksum, cryptographic signature, or expected Git commit before copying `SKILL.md` into the Agent's persistent Skill directory. Consequently, the content installed by a user can differ from the content reviewed during this audit. Although the currently audited `SKILL.md` contains no confirmed malicious payload, future modification or compromise of the upstream repository could replace it with attacker-controlled Agent instructions. The copied file is stored under `~/.claude/skills`, where it may be loaded in later Agent sessions. This makes the supply-chain trust decision particularly important because the installed artifact can influence future tool use and Agent behavior. ### Attack Path 1. An attacker compromises the upstream GitHub account, repository, default branch, or a maintainer credential. 2. The attacker changes `SKILL.md` to include malicious or deceptive Agent instructions. 3. A user runs `install.sh` or the README installation command. 4. Git retrieves the latest attacker-controlled default-branch content because no immutable commit is specified. 5 ...[truncated 955 chars]- Remediation
View remediation
" git clone --no-checkout "$REPO_URL" "$TMPDIR/nobodybuilt" git -C "$TMPDIR/nobodybuilt" checkout --detach "$EXPECTED_COMMIT" ``` 2. Publish signed releases and verify the release signature before installation. 3. Publish a SHA-256 digest for `SKILL.md` and fail closed if the downloaded file does not match: ```bash echo " $TMPDIR/nobodybuilt/SKILL.md" | sha256sum --check - ``` 4. Do not suppress all Git error output with `2>/dev/null`; users should be able to inspect certificate, repository, and checkout failures. 5. Update the README installation command to reference the same immutable release or commit used by the installer. 6. Show the exact source revision and destination before copying the Skill, and request confirmation when installation is performed by an Agent. 7. Document that files placed in `~/.claude/skills` persist across sessions and should be reviewed before activation. ]]>