T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:41
- Finding
- Unpinned Remote Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 41-50 **Vulnerability Type**: Unverified and mutable remote dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation Add TikTok Live Commerce to your AI agent's skill registry: ```bash # Via skill manager (recommended) skill-install tiktok-live-commerce # Or manually add to agent config echo "tiktok-live-commerce: https://www.pinghuman.ai/skills/tiktok-live-commerce/skill.md" >> ~/.agent/skills.txt ``` ``` ### Technical Analysis The installation procedure either invokes an opaque package installation command without an explicit version or adds a mutable remote Skill URL directly to the agent's persistent configuration. Neither method specifies an immutable version, cryptographic checksum, signature, trusted registry policy, or review requirement. As a result, the Skill content loaded by an agent in the future may differ from the content reviewed during this audit. HTTPS protects data in transit but does not guarantee that the publisher account, hosting service, DNS configuration, or remote file will remain uncompromised or unchanged. This is classified as `T08: Insecure Dependencies` because the effective Skill is obtained through an unpinned external supply-chain source. The reviewed file does not itself demonstrate malicious remote content or automatic native-code execution; the risk arises from trusting a mutable dependency. ### Attack Path 1. A user follows the documented installation instructions. 2. The command installs the Skill without an explicit immutable version, or the remote URL is appended to `~/.agent/skills.txt`. 3. The remote Skill file or its hosting infrastructure is subsequently modified or compromised. 4. During a later session, the agent loads instructions from the same trusted-looking URL. 5. The altered instructions execute with the tools and permissions available ...[truncated 1139 chars]
- Remediation
- ## Remediation Suggestions 1. Distribute the reviewed Skill content inside the package rather than loading mutable instructions from a remote URL. 2. Pin installations to an exact, immutable Skill version instead of using only `tiktok-live-commerce`. 3. Publish a SHA-256 or stronger cryptographic digest and verify it before installation or loading. 4. Sign Skill releases and configure the installer to reject missing, invalid, expired, or untrusted signatures. 5. Document the registry used by `skill-install` and restrict resolution to an allowlisted HTTPS registry with verified publisher identities. 6. Do not automatically refresh remote Skill instructions. Require explicit review and approval before updating persistent agent configuration. 7. Record the resolved version and digest in a lockfile or equivalent manifest so the installed artifact can be reproduced and audited. 8. Apply least privilege to agents that load third-party Skills, particularly for credentials, messaging, task approval, and payment-related API operations. 9. Provide uninstall and incident-response instructions for removing the persistent entry from `~/.agent/skills.txt` if the remote resource is compromised.