T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Automatic Installation of Unverified Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-42`; `references/tool-setup-guide.md:16-18, 90-105, 145-170` **Vulnerability Type**: Unsafe dependency discovery and automatic installation **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:35-42`: ```markdown 4. 遇到工具缺失、运行时未安装、权限不足、编译器缺失或环境未配置时，必须读取 `references/tool-setup-guide.md` 并按其中流程处理 5. 能自动安装或自动配置时优先自动完成；确实无法自动完成时，再切换手动模式并让用户在本地终端或文件管理器执行 ``` This instructs the Agent to prioritize automatic installation or configuration whenever possible. `references/tool-setup-guide.md:16-18`: ```markdown - 先确认工具是否真实可用，不要凭空假设 - 能自动安装就自动安装，能自动配置就自动配置 - 不能自动完成时，再切换手动模式 ``` `references/tool-setup-guide.md:99-105`: ```markdown | macOS | Homebrew | `brew install node` | | macOS (无 Homebrew) | 官网安装包 | 访问 https://nodejs.org → 下载 LTS | | Ubuntu / Debian | apt | `sudo apt update && sudo apt install nodejs npm` | | CentOS / RHEL | yum | `sudo yum install nodejs npm` | | Windows | 官网安装包 | 访问 https://nodejs.org → 下载 LTS → 双击安装 | | Windows (有 winget) | winget | `winget install OpenJS.NodeJS.LTS` | | 任意平台 | nvm（版本管理器） | https://github.com/nvm-sh/nvm | ``` `references/tool-setup-guide.md:151-170`: ```markdown - `https://<tool-name>.dev/docs/installation` - `https://<tool-name>.io/getting-started` - `https://docs.<tool-name>.com` | `npm` | Node.js 工具 | `npm search <tool-name>` | | `pip` | Python 工具 | `pip search <tool-name>` 或查 https://pypi.org | `https://github.com/<org>/<tool-name>` 直接搜索 `<tool-name> installation guide <platform>` 获取最新安装方式。 ``` ### Technical Analysis The Skill's execution protocol authorizes the Agent to discover and automatically install missing tools. Discovery may be performed through package-manager searches, guessed documentation domains, GitHub repositories, or general web search. The protocol does not require: - Explicit user approval before installation - An allowlist of acceptable packages or publishers - Verification that a package is maintained by the legitima ...[truncated 2158 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user approval before installing any package, runtime, compiler, or system tool. 2. Maintain an allowlist of approved package names, publishers, registries, and official download domains. 3. Reject package names supplied solely through untrusted generated requirements unless their identity is independently verified. 4. Pin exact package versions and verify cryptographic hashes or signatures where supported. 5. Inspect package metadata, publisher history, repository ownership, transitive dependencies, and lifecycle scripts before installation. 6. For npm, use lockfiles and consider `--ignore-scripts` during initial inspection. 7. Install generated-Skill dependencies in an isolated, least-privilege environment rather than globally. 8. Prohibit unattended `sudo`, administrator, or system-wide installation. 9. Replace guessed documentation URLs and unrestricted web searches with verified official project records. 10. Record the dependency name, source, version, integrity value, requested privileges, and proposed commands in the approval prompt. ]]>