T08 · Insecure Dependencies
Warning
- Location
SKILL.md:130- Finding
Unpinned and Unattended Third-Party Skill Installation
- Content
View full analysis
-y ``` ### Technical Analysis The documented installation command installs the `anygen-workflow-generate` third-party skill without specifying an immutable version, commit, digest, verified source, checksum, or cryptographic signature. The `-y` option also suppresses interactive confirmation. As a result, the installed dependency may differ from the version originally reviewed. If the package registry, publisher account, package distribution channel, or dependency itself is compromised, the command could install modified skill instructions or executable components without giving the user an opportunity to inspect the changes. This is a supply-chain weakness rather than evidence that the current dependency is malicious. The audited project contains only `SKILL.md`; no embedded malicious scripts or payloads were found in the project itself. ### Attack Path 1. An attacker compromises the publisher account, package registry, or distribution channel for `anygen-workflow-generate`. 2. The attacker publishes a modified release under the expected package name. 3. A user or Agent follows the documented installation command. 4. Because no immutable version or digest is specified, the installer retrieves the attacker-controlled release. 5. The `-y` option allows installation to proceed without an explicit review or confirmation step. 6. When the installed skill is loaded or invoked, its altered instructions or executable components run with the permissions available to the hosting Agent. ### Impact Assessment A compromised dependency could influence Agent behavior and access the tools granted to the installed skill. Depending on the hosting platform’s permissions, the impact could include un ...[truncated 477 chars]- Remediation
View remediation