T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:60
- Finding
- Unpinned External Runner Is Installed and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60-79 **Vulnerability Type**: Unverified external dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```text https://github.com/sensedeal/cue-skills https://gitee.com/sensedeal/cue-skills ``` ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "Target industry cycle and competitive landscape analysis" \ --template-id template_qcPkH8 \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-industry-competition.md ``` The surrounding instructions state that first-time setup installs the runner by cloning it from the referenced external repository. However, no commit hash, immutable release identifier, checksum, or signature is specified. The advertised one-click installer is also absent from the reviewed artifact, with the installation code block left empty. ### Technical Analysis The Skill's primary operation depends on code retrieved separately from a mutable third-party repository. It then directs the Agent to execute that code from `~/.cue/cue-skills`. Because no immutable revision or integrity verification is required, the code reviewed by a user at one point may differ from the code later installed and executed. Repository compromise, maintainer account compromise, malicious upstream changes, or mirror substitution could therefore introduce attacker-controlled behavior after this Skill has been reviewed. This is a supply-chain weakness rather than evidence that the current repository contains malicious code. The project contains only `SKILL.md`, so the actual behavior of `research_run.py` and the claimed installer could not be audited. The health-check pipeline at line 135 is not remote code execution. It sends an authenticated HTTPS request and passes the returned JSON to a fixed local Python parser; it does not pipe the response into Bash or evaluate it as Python source. ### Attack Path 1. A user follows the Skill's first-use setup dire ...[truncated 1567 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin an immutable revision** - Reference a specific audited Git commit or immutable release instead of a mutable default branch. - Apply the same pinning policy to both the GitHub source and Gitee mirror. 2. **Verify integrity before execution** - Publish a SHA-256 digest for the installer and runner release. - Verify the digest locally before executing any downloaded file. - Prefer signed release artifacts and verify signatures against a documented maintainer key. 3. **Include auditable installation logic** - Add the actual installer to the Skill package rather than referring to a missing one-click script. - Document all files created, commands executed, repositories contacted, and configuration values accessed. 4. **Avoid automatic execution after download** - Separate download, inspection, verification, and execution into distinct steps. - Do not use remote-script-to-shell pipelines. - Require installation to fail closed when signature or checksum validation fails. 5. **Reduce credential exposure** - Provide the runner only the specific Cue credential required for the request. - Avoid exposing unrelated environment variables or filesystem locations. - Use a narrowly scoped and revocable API token where supported. 6. **Constrain runtime privileges** - Run the external runner under a dedicated low-privilege account or sandbox. - Restrict filesystem access to its configuration and output directories. - Restrict outbound network access to documented Cue API endpoints where practical. 7. **Document update controls** - Require explicit review before changing the pinned runner revision. - Publish release notes and reproducible build information for every approved update. ]]>