T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:66
- Finding
- Execution of an Unbundled and Unverified Installation Script<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 66-73 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash To install the workflow-engine and enable its hooks: ```bash # Clone or navigate to the workflow-engine directory cd workflow-engine # Run the install script to set up hooks ./install-hooks.sh ``` ### Technical Analysis The installation instructions direct users to enter a directory named `workflow-engine` and execute `install-hooks.sh`. Neither that directory nor the script is included in the audited project. The instructions also do not specify a trusted download source, pinned version, cryptographic checksum, or signature. Consequently, the effective installation payload is determined by whichever local directory and script happen to use those names. The script's behavior cannot be verified from the audited package, creating a supply-chain trust gap and an opportunity for directory or script substitution. ### Attack Path 1. An attacker distributes, creates, or replaces a local directory named `workflow-engine`. 2. The attacker places a malicious `install-hooks.sh` file in that directory. 3. A user follows the documented installation instructions and runs `cd workflow-engine`. 4. The user executes `./install-hooks.sh` without any prescribed integrity verification. 5. The malicious script runs with the privileges of that user and can perform any action available to that account. ### Impact Assessment Successful exploitation provides arbitrary command execution under the installing user's account. Depending on that account's privileges, the script could modify files, access user-readable data, alter application configuration, install persistent components, or invoke other local tools. The audited files do not demonstrate automatic privilege escalation, so impact is limited to the permissions held by the user executing the script. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the script-execution instruction if installation is outside this skeleton's intended scope. - If the script is required, include it in the reviewed package so its behavior can be audited. - Specify an authoritative repository URL and pin the dependency to an immutable release or commit. - Publish and require verification of a cryptographic checksum or signed release before execution. - Instruct users to inspect the script before running it. - Execute installation with the minimum necessary privileges and avoid recommending elevated execution. - Document the files, hooks, and configuration changes made by the installer. ]]>