T08 · Insecure Dependencies
- Location
SKILL.md:33- Finding
Automatic Installation of Unverified Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 33
Vulnerability Type: Insecure dependency installation
Risk Level: MediumVulnerable Code Snippet
markdown **缺少依赖** → 先安装再执行English translation: “Missing dependency → install it first, then execute.”
Technical Analysis
This instruction directs the agent to install missing dependencies automatically before continuing execution. It does not require:
- Explicit user authorization
- Validation of the inferred package name
- Use of an approved package registry
- Version or cryptographic hash pinning
- Inspection of package provenance
- Isolation or least-privilege execution
- Disabling package installation hooks
An attacker may influence a task, project, error message, or dependency reference so that the agent infers and installs an attacker-controlled package. This creates exposure to typosquatting and dependency-confusion attacks. Package managers may execute installation hooks immediately, allowing malicious code to run before the requested task resumes.
Attack Path
- The agent processes an untrusted project or task that refers to a missing dependency.
- The project, task content, or generated error causes the agent to infer an attacker-selected or ambiguous package name.
- Following the Skill instruction, the agent installs the package without requesting approval or validating its identity and origin.
- The package manager retrieves a malicious package from a configured registry.
- Installation hooks or imported package code execute with the agent process's permissions.
- The malicious package may access files and credentials available to that process, modify the working environment, or execute additional commands.
Impact Assessment
Successful exploitation can provide arbitrary code execution with the permissions of the user or service running the agent. The affected scope may include the project workspace, environment variables, package-manager credent ...[truncated 396 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace automatic installation with a requirement to obtain explicit user approval.
- Determine dependencies from reviewed manifests or lockfiles rather than error text or untrusted task content.
- Restrict installation to approved registries and verify package namespace and publisher identity.
- Pin exact versions and cryptographic hashes through a lockfile or equivalent integrity mechanism.
- Detect potential typosquatting and dependency-confusion conditions before installation.
- Review package metadata and installation scripts before allowing execution.
- Disable lifecycle or installation scripts where the package manager supports doing so.
- Install dependencies inside an isolated, disposable, least-privilege environment.
- Avoid exposing unrelated credentials, sensitive environment variables, or host directories to the installation process.
- Record the selected package, version, registry, and verification outcome in an audit log.
A safer replacement instruction would be:
markdown If a dependency is missing, identify it from a trusted manifest, explain the required package and source, and request user approval before installing an exact, verified version in an isolated environment.