T08 · Insecure Dependencies
Warning
- Location
- README.md:8
- Finding
- Unpinned Skill Installation from a Mutable Remote Repository## Vulnerability Details **File Location**: `README.md`, line 8 **Vulnerability Type**: Supply-chain risk caused by an unpinned remote dependency **Risk Level**: Medium ### Vulnerable Code ```bash gemini skills install https://github.com/socratescli/webcodecs-string-finder-skill ``` ### Technical Analysis The documented installation command retrieves the Skill directly from a mutable GitHub repository without specifying a reviewed commit hash, immutable release artifact, or integrity checksum. Consequently, the content installed by a user can differ from the content examined during this audit. This does not demonstrate that the repository currently contains malicious content. However, if the repository, maintainer account, or release workflow is compromised, an attacker could alter `SKILL.md` or add executable components. Subsequent users following the documented command would install the modified version. Reloading the installed Skill, as instructed elsewhere in the README, could then expose the agent to attacker-controlled instructions or other payloads. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its publishing workflow. 2. The attacker modifies the repository by adding malicious Skill instructions or executable content. 3. A user runs the unpinned installation command from `README.md`. 4. The installer retrieves the current attacker-modified repository state rather than the version reviewed in this audit. 5. The user reloads or invokes the Skill. 6. The malicious content operates with whatever tools, files, network access, and permissions the hosting agent grants to the installed Skill. ### Impact Assessment The immediate project content reviewed in `README.md` and `SKILL.md` contains no embedded malicious code, credential access, persistence mechanism, destructive behavior, or instruction hijacking. The risk arises from future substitution of the remotely retriev ...[truncated 432 chars]
- Remediation
- ## Remediation Suggestions - Pin installation to a specific, reviewed commit hash or immutable signed release rather than the repository's mutable default branch. - Publish the expected cryptographic checksum for the reviewed artifact and require verification before installation. - Sign release artifacts and document signature verification using a trusted maintainer key. - Protect the upstream repository with multi-factor authentication, branch protection, mandatory review, and restricted release permissions. - Add automated security checks to the release workflow and ensure that published version metadata corresponds to the immutable reviewed source. - Advise users to inspect changes and repeat the security review before upgrading to a different commit or release.