T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:49
- Finding
- Unpinned Remote Skill Installation and Persistent Registry Reference## Vulnerability Details **File Location**: `SKILL.md`, lines 49–52 **Vulnerability Type**: Unpinned third-party Skill dependency **Risk Level**: Medium ### Vulnerable Code ```bash # Via skill manager (recommended) skill-install tiktok-trend-challenger # Or manually add to agent config echo "tiktok-trend-challenger: https://www.pinghuman.ai/skills/tiktok-trend-challenger/skill.md" >> ~/.agent/skills.txt ``` ### Technical Analysis The installation instructions do not pin the Skill to an immutable version, commit, cryptographic digest, or verified signature. The manual installation method also creates a persistent registry entry that points directly to a mutable remote `SKILL.md`. Consequently, the content loaded in a future agent session may differ from the content reviewed during this audit. Although the audited file does not itself contain a malicious payload, compromise or unauthorized modification of the remote resource could turn this installation mechanism into a supply-chain delivery channel. The `skill-install` example likewise provides no explicit source validation or integrity-verification procedure. ### Attack Path 1. A user follows the documented installation instructions. 2. The manual method records the remote PingHuman Skill URL in `~/.agent/skills.txt`, or the Skill manager resolves the unpinned package name. 3. The referenced remote Skill content is subsequently modified or its hosting/distribution channel is compromised. 4. In a later session, the agent or Skill manager retrieves the changed content without comparing it against a trusted digest or signature. 5. The agent processes the substituted instructions as trusted Skill content. 6. Those instructions could induce unauthorized API operations, redirect data to an attacker-controlled service, or otherwise alter behavior within the permissions available to the agent. Exploitation therefore requires control of, or the ability to tamper wi ...[truncated 731 chars]
- Remediation
- ## Remediation Suggestions 1. Distribute the audited Skill as a local, versioned artifact rather than loading mutable documentation directly from a remote URL. 2. Pin installation to an immutable release identifier, commit, or content-addressed artifact. 3. Publish a SHA-256 digest or signed manifest and verify it before activating the Skill. 4. Configure the Skill manager to reject unsigned content and fail closed when integrity verification fails. 5. Record the verified version and digest in `~/.agent/skills.txt` instead of only recording a mutable URL. 6. Require explicit user review and confirmation whenever retrieved Skill content differs from the previously approved digest. 7. Document the authoritative package source and provide a secure update procedure with rollback support. 8. Apply least privilege to agents loading third-party Skills, particularly for credentials, payment actions, and task-approval APIs.