T08 · Insecure Dependencies
Warning
- Location
SKILL.md:375- Finding
Unpinned Third-Party Validator Download and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:375-378
Vulnerability Type: Unpinned third-party package execution
Risk Level: MediumVulnerable Code
markdown Run the official Agent Skills validator before publishing: ```bash uvx --from skills-ref agentskills validate path/to/skilltext ### Technical Analysis The documented command directs `uvx` to obtain and execute the `skills-ref` package without specifying an exact version, lockfile, or integrity hash. Consequently, the code executed by users or CI runners may differ from the version that existed when this Skill was audited. This creates a supply-chain risk: compromise of the package publisher, package registry, release process, or a future package version could cause attacker-controlled code to run when users follow the validation workflow. Although validation is legitimate to the Skill's declared functionality, executing an unpinned package exceeds the minimum-risk approach because reproducible and integrity-verified alternatives are available. This finding is distinct from remote shell-script execution. The project contains no actual instruction to execute `curl | bash`; `references/clawhub-publishing.md:29` mentions that pattern only to prohibit it. ### Attack Path 1. An attacker compromises the `skills-ref` package account, release pipeline, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the expected package name. 3. A user or CI pipeline follows the documented `uvx --from skills-ref ...` instruction. 4. `uvx` retrieves the currently resolved package release rather than a previously reviewed, pinned artifact. 5. The malicious package code executes with the privileges and environmental access of the invoking user or CI runner. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking account. In a developer environment, this may expose source code, local credentials, SSH mat ...[truncated 426 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
skills-refto an exact, reviewed version rather than allowing unconstrained resolution. - Use a lockfile or package-manager mechanism that records the complete dependency graph.
- Verify package artifacts with trusted hashes or signatures where supported.
- Document the canonical publisher and source repository so users can verify package provenance.
- In CI, install the pinned validator in a restricted build step and run it with minimal credentials, filesystem access, and network permissions.
- Prefer a preinstalled and independently verified validator when available.
- Establish a controlled update process that reviews and tests each new validator version before changing the pin.
- Pin