T08 · Insecure Dependencies
- Location
SKILL.md:55- Finding
Execution Delegated to Unverified External Programs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 55-57, 64, 156-157, and 165-167
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
SKILL.md, lines 55-57:text **Installation path**: `~/.workbuddy/skills/graphify.py` **Status**: Installed and configured **Invocation method**: Use the `/graphify` command directly in the AI assistantSKILL.md, line 64:bash graphify .SKILL.md, lines 156-157:text /graphify build . /graphify query "what..."SKILL.md, lines 165-167:bash python ~/.workbuddy/skills/graphify.py build . python ~/.workbuddy/skills/graphify.py query "what is the structure?"Technical Analysis
The audited package contains only
SKILL.md; it does not include the referencedgraphify.pyimplementation, an installation procedure, a dependency lockfile, a cryptographic hash, or another mechanism that establishes the executable's provenance and integrity.The bare
graphifycommand relies on operating-systemPATHresolution. The Python invocation separately trusts a mutable file under the user's home directory. Neither target is controlled or verified by the audited package. As a result, the instructions can execute code whose contents were not included in the security review.This is an insecure dependency and executable-resolution boundary. A malicious or previously compromised executable at either location could run under the identity and permissions of the user or agent following the instructions. The documented workflow supplies repository paths to that executable and recommends configuring API credentials in the process environment, increasing the sensitivity of the execution context.
The documentation also makes inconsistent claims about data handling: it describes operation as fully local while later stating that semantic extraction can use Anthropic or OpenAI API keys. Because t ...[truncated 1877 chars]
- Remediation
View remediation
Remediation Suggestions
- Include the executable implementation within the reviewed skill package rather than relying on a mutable file in the user's home directory.
- Invoke the implementation through a canonical package-relative path instead of a bare command resolved through
PATH. - If an external artifact is unavoidable, document its authoritative source and pin an immutable release version and cryptographic SHA-256 hash.
- Verify the artifact's signature or hash before every installation or execution, and fail closed when verification does not succeed.
- Provide a reproducible installation process and dependency lockfile with hashes for all transitive dependencies.
- Restrict repository access to explicitly selected directories and run the executable with the minimum required filesystem and network permissions.
- Do not expose API credentials to AST parsing or other stages that do not require them. Supply narrowly scoped credentials only to the relevant process.
- Clearly disclose which files or extracted content may be sent to external LLM providers and require explicit user consent before transmission.
- Add tests or policy checks that reject execution when the resolved executable is outside the expected package directory or has unexpected ownership or permissions.
- Remove the contradictory claims of fully local operation unless the configured endpoint and implementation guarantee that no data leaves the host.