T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:38
- Finding
- Unpinned Mutable Remote Skill Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 38-45 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash # Via skill manager (recommended) skill-install tiktok-viral-marketing # Or manually add to agent config echo "tiktok-viral-marketing: https://www.pinghuman.ai/skills/tiktok-viral-marketing/skill.md" >> ~/.agent/skills.txt ``` ### Technical Analysis The documented installation methods do not pin the skill to an immutable version, cryptographic digest, or verified signature. In particular, the manual method registers a remotely hosted `skill.md` URL in persistent agent configuration. The effective instructions obtained from that URL may therefore change after this version of the project has been reviewed. If the package namespace, distribution infrastructure, hosting account, or remote document is compromised, an attacker could replace the reviewed instructions with attacker-controlled content. The next installation or reload could then expose the agent to instructions that were not present during this audit. The configuration command also appends entries without checking for an existing registration, potentially creating duplicate or conflicting skill definitions. No currently malicious remote payload or malicious executable code was identified in the audited artifact; the risk arises from the mutable and unverified dependency mechanism. ### Attack Path 1. A user follows one of the documented installation procedures. 2. The skill manager resolves an unpinned package, or the manual procedure registers the mutable remote URL in `~/.agent/skills.txt`. 3. An attacker compromises the package namespace, remote hosting infrastructure, or skill publication account. 4. The attacker replaces the remotely distributed skill instructions with unauthorized content. 5. During a subsequent installation, update, or configuration reload, the agent retrie ...[truncated 872 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an immutable, explicitly reviewed version rather than resolving the latest package by name. 2. Publish and verify a cryptographic digest or digital signature for the skill file before installation or loading. 3. Prefer a reviewed local copy or content-addressed immutable URL over a mutable remote `skill.md` URL. 4. Restrict installation to an allowlisted registry with authenticated publishing, namespace ownership controls, and audit logging. 5. Require explicit user approval when a skill's content or digest differs from the previously approved version. 6. Replace unconditional configuration appending with an idempotent registration process that detects duplicate or conflicting entries. 7. Run newly installed or updated skills with least-privilege tool access and require confirmation for sensitive API, filesystem, credential, and payment operations.