T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:21
- Finding
- Unbounded Third-Party Skill and MCP Installation Workflow## Vulnerability Details **File Location**: `SKILL.md:21-43` **Vulnerability Type**: Untrusted third-party component installation and invocation **Risk Level**: Medium **Complete vulnerable snippet:** ```markdown ## 能力边界与技能协作 > 本 Skill 是一个**语言模型指令集**，专精于白月光风格的聊天回复生成。 当用户提出以下类型的问题时，本 Skill 可能无法直接处理： | 用户需求类型 | 处理方式 | | --- | --- | | 编程/技术问题 | 检索并安装相关编程技能，或推荐安装 | | 知识问答/百科 | 检索并安装通用问答技能，或推荐安装 | | 其他风格写作（非白月光） | 检索并安装对应风格的写作技能，或推荐安装 | | 数据分析/计算 | 检索并安装相关工具技能，或推荐安装 | | 图片/文件处理 | 检索并安装对应 MCP 服务，或推荐安装 | | 超出聊天回复范围的需求 | 先判断是否有已安装技能可处理；若无，推荐安装合适的技能 | **处理流程：** 1. 判断用户需求是否在本 Skill 的能力范围内（白月光风格聊天回复） 2. 若在范围内 → 正常生成回复 3. 若不在范围内 → 先检索已安装技能是否能解决 4. 若有合适技能 → 使用该技能处理 5. 若没有合适技能 → 向用户推荐可安装的技能名称及简要说明 > 核心原则：不硬答能力之外的问题，善用技能生态协作解决问题。 ``` The behavior is also documented in `README.md:45`: ```markdown > 📌 **能力边界**：本 Skill 专精于白月光风格的聊天回复生成。如果你遇到其他类型的问题，我作为语言模型会检索已安装技能来协助解决；若没有合适技能，会推荐你可以安装的技能。不硬答能力之外的问题，善用工具生态协作。 ``` ### Technical Analysis The Skill instructs the Agent to search for, install, recommend, and invoke unspecified third-party skills or MCP services whenever a request falls outside its writing scope. It defines no trusted registry or component allowlist, package identity requirements, publisher verification, version pinning, integrity validation, permission review, sandboxing, or mandatory user approval. This creates an unsafe supply-chain boundary. Search-based component selection can expose the Agent to dependency confusion, typosquatting, malicious publishers, compromised packages, or components whose permissions exceed the original Skill's needs. The installation behavior is also unrelated to the Skill's declared purpose of generating stylized chat replies. The repository itself does not contain a malicious dependency or an automated installer. Exploitation therefore depends on the hosting Agent supporting ecosystem search or installation and following these instructions. ### Attack Path 1 ...[truncated 1764 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all instructions that allow automatic installation of arbitrary skills or MCP services. 2. For out-of-scope requests, either decline safely or provide a non-executing recommendation without installing or invoking anything. 3. If third-party integrations are necessary, use a narrowly scoped allowlist of reviewed components from trusted registries. 4. Pin each approved component to an exact version and verify a cryptographic digest or trusted signature before use. 5. Require explicit, informed user approval before every installation, including the component identity, publisher, version, source, requested permissions, and reason it is needed. 6. Apply least privilege by denying filesystem, process, network, credential, and persistence permissions unless individually required. 7. Run external components in a sandbox with restricted network egress, read-only or isolated filesystems, resource limits, and no inherited secrets. 8. Record installation and invocation events in an auditable log and provide a straightforward uninstall or revocation mechanism. 9. Update `README.md:45` so its documented behavior matches the hardened workflow. 10. Add policy tests ensuring that unrelated requests cannot trigger installation or execution without allowlist validation and explicit approval.