T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:41
- Finding
- Mutable Remote Skill Dependency Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 41–44 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash # Via skill manager (recommended) skill-install tiktok-ugc-creator # Or manually add to agent config echo "tiktok-ugc-creator: https://www.pinghuman.ai/skills/tiktok-ugc-creator/skill.md" >> ~/.agent/skills.txt ``` ### Technical Analysis The installation instructions either invoke an unspecified skill package by name or add a mutable remote skill URL to the agent's persistent skill registry. Neither method pins the dependency to a reviewed version, immutable commit, cryptographic digest, or trusted signature. HTTPS protects the network connection in transit, but it does not ensure that the content returned by the URL remains identical to the artifact reviewed during this audit. A compromise of the skill manager, package source, PingHuman hosting account, or remote web service could therefore alter the instructions subsequently loaded by the agent. The configuration append also causes the agent to continue resolving this remote dependency in future sessions. This is persistence of a dependency configuration, not evidence that the current artifact installs a system backdoor. ### Attack Path 1. A user follows the documented installation procedure. 2. The skill manager resolves `tiktok-ugc-creator`, or the remote URL is written to `~/.agent/skills.txt`. 3. An attacker compromises the relevant package source, installer, PingHuman hosting account, or upstream service. 4. The attacker replaces the remotely served skill with modified instructions. 5. During a later skill load, the agent retrieves or resolves the changed content without checking a version, signature, or expected hash. 6. The modified instructions can influence the agent with the permissions and tools available in that runtime. ### Impact Assessment Successful exploitation could allow attacker-controlled skill instructions t ...[truncated 445 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the skill to an immutable, reviewed release, commit identifier, or content-addressed artifact. 2. Publish a SHA-256 or stronger digest and verify it before registering or loading the skill. 3. Require signed releases and validate signatures against a documented trusted key. 4. Download the reviewed skill to local storage rather than retaining a mutable remote URL in persistent configuration. 5. Explicitly identify and authenticate the trusted skill-manager registry and package publisher. 6. Fail closed when version, signature, or digest verification cannot be completed. 7. Re-audit the dependency before upgrades and require explicit approval for version changes. 8. Run externally sourced skills with least privilege, restricting filesystem, credential, network, and API access to what the skill legitimately requires.