T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:34
- Finding
- Unverified Mutable Remote Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34-40 **Vulnerability Type**: Unverified third-party skill dependency **Risk Level**: Medium ### Vulnerable Code ```bash # Via skill manager (recommended) skill-install tiktok-product-promotion # Or manually add to agent config echo "tiktok-product-promotion: https://www.pinghuman.ai/skills/tiktok-product-promotion/skill.md" >> ~/.agent/skills.txt ``` ### Technical Analysis The installation instructions register a third-party skill by package name or mutable HTTPS URL without specifying an immutable version, cryptographic digest, or trusted signature. The manual installation method also persistently adds the remote URL to the agent's skill registry. Consequently, the content loaded in a later session may differ from the content reviewed during this audit. If the package registry, hosting account, DNS configuration, TLS termination infrastructure, or upstream publication process is compromised, an attacker could replace the remote skill document with attacker-controlled instructions. This finding does not demonstrate direct operating-system code execution in the audited project. The immediate risk is a supply-chain substitution affecting instructions subsequently loaded by an agent. Any resulting capabilities would be limited to the tools, credentials, filesystem access, network access, and approval boundaries available to that agent. ### Attack Path 1. A user follows one of the documented installation methods. 2. The agent registry stores or resolves the skill using its unpinned name or mutable remote URL. 3. An attacker compromises the skill publication channel or otherwise gains the ability to modify the remotely served skill. 4. The attacker replaces the reviewed content with malicious or misleading instructions. 5. During a later session, the agent retrieves and loads the modified skill without integrity verification. 6. The malicious instructions attempt actions through the a ...[truncated 728 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the skill to an immutable, explicitly reviewed version rather than resolving only its package name or a mutable URL. 2. Publish and require a cryptographic digest, such as SHA-256, for the exact skill artifact. 3. Digitally sign releases and configure the installer to verify signatures against a separately distributed trusted public key. 4. Fail closed when version, digest, or signature validation fails. 5. Store a verified local copy instead of automatically loading mutable remote instruction text during each session. 6. Restrict skill updates to an explicit review and approval workflow, and display content changes before activation. 7. Document the trust boundary and security properties of `skill-install`, including its registry source, signature policy, and update behavior. 8. Run installed skills with least-privilege tool access, scoped API credentials, network allowlists, and confirmation requirements for sensitive operations. ]]>