T08 · Insecure Dependencies
Error
- Location
scripts/activate.sh:134- Finding
Unpinned Third-Party Content Can Inject Workspace-Level Agent Instructions
- Content
View full analysis
"$WORKSPACE_DIR/AGENTS.md" ``` ### Technical Analysis The setup script clones a mutable third-party Git repository, and the update script pulls the latest state of its `main` branch. Neither operation pins a reviewed commit or release, verifies a cryptographic checksum, validates a signed tag or commit, or restricts updates to an approved manifest. The activation script subsequently takes the body of a Markdown file from that repository and writes it directly into the workspace-level `AGENTS.md`. This file is intended to contain instructions that influence Agent behavior. The script removes YAML frontmatter but does not inspect, sanitize, or restrict the remaining instruction content. Consequently, the effective Agent instructions can change after this Skill has been reviewed. A compromise of the upstream repository, its maintainer account, or its release process could introduce hostile instructions without requiring changes to the audited Skill package itself. The audited project does not contain evidence that the current upstream content is malicious. The vulnerability is the unrestricted trust boundary between mutable remote content and a behavior-controlling workspace file. ### Attack Path 1. An attacker c ...[truncated 1609 chars]- Remediation
View remediation