T08 · Insecure Dependencies
Warning
- Location
setup.sh:4- Finding
Unpinned Remote Skill Instructions Create a Supply-Chain Risk
- Content
View full analysis
Vulnerability Details
File Location:
setup.sh:4, 12-19
Vulnerability Type: Unpinned remote dependency containing trusted agent instructions
Risk Level: MediumVulnerable Code
bash REPO_URL="https://github.com/anthropics/knowledge-work-plugins.git" TMP_DIR="$(mktemp -d)" cleanup() { rm -rf "$TMP_DIR"; } trap cleanup EXIT echo "Fetching dependencies from ${REPO_URL%.git}..." git clone --depth 1 --quiet "$REPO_URL" "$TMP_DIR" for dir in "$TMP_DIR/human-resources/skills"/*/; do name="$(basename "$dir")" mkdir -p "$SKILL_DIR/sub-skills/$name" cp "$dir/SKILL.md" "$SKILL_DIR/sub-skills/$name/SKILL.md" echo " + $name" doneThe downloaded files are subsequently designated as trusted sub-skill instructions by
SKILL.md:16-29:markdown ## Sub-Skills Read the appropriate sub-skill file for detailed instructions: | Sub-Skill | File | When to Use | |---|---|---| | recruiting-pipeline | [sub-skills/recruiting-pipeline/SKILL.md](sub-skills/recruiting-pipeline/SKILL.md) | Pipeline status, hiring velocity, candidate tracking, conversion metrics | | comp-analysis | [sub-skills/comp-analysis/SKILL.md](sub-skills/comp-analysis/SKILL.md) | Compensation benchmarking, offer competitiveness, equity modeling | | people-report | [sub-skills/people-report/SKILL.md](sub-skills/people-report/SKILL.md) | Headcount, attrition, diversity, org health metrics | | performance-review | [sub-skills/performance-review/SKILL.md](sub-skills/performance-review/SKILL.md) | Self-assessments, manager reviews, calibration prep | | org-planning | [sub-skills/org-planning/SKILL.md](sub-skills/org-planning/SKILL.md) | Headcount planning, team structure, reorg design | | draft-offer | [sub-skills/draft-offer/SKILL.md](sub-skills/draft-offer/SKILL.md) | Offer letters, total comp packages, negotiation guidance | | interview-prep | [sub-skills/interview-prep/SKILL.md](sub-skills/interview-prep/SKILL.md) | Interview plans, question banks, scorecards, debrief templ ...[truncated 2697 chars]- Remediation
View remediation
Remediation Suggestions
- Pin the upstream dependency to a reviewed full commit SHA rather than cloning the mutable default branch.
- Maintain an allowlist of expected sub-skill paths and SHA-256 hashes, and verify every copied file before installation.
- Fail closed if the pinned revision cannot be retrieved, a signature cannot be verified, a hash differs, or an unexpected file appears.
- Prefer vendoring reviewed sub-skill files into the distributed package so its effective behavior is auditable and immutable.
- If remote updates are required, retrieve a signed release and verify its signature against a separately distributed trusted public key.
- Review updates before activating them and display the exact upstream revision installed.
- Install into a staging directory, validate all content, and only then atomically replace the active sub-skills.
- Apply least-privilege permissions to HR connectors so downloaded instructions cannot independently access or modify data beyond the active task.
A pinned checkout could follow this pattern:
bash REPO_URL="https://github.com/anthropics/knowledge-work-plugins.git" EXPECTED_COMMIT="REPLACE_WITH_REVIEWED_FULL_COMMIT_SHA" git clone --no-checkout --quiet "$REPO_URL" "$TMP_DIR" git -C "$TMP_DIR" checkout --detach "$EXPECTED_COMMIT" actual_commit="$(git -C "$TMP_DIR" rev-parse HEAD)" if [[ "$actual_commit" != "$EXPECTED_COMMIT" ]]; then echo "Unexpected dependency revision" >&2 exit 1 fi sha256sum --check "$SKILL_DIR/sub-skills.sha256"The checksum manifest must be generated from independently reviewed content and must not be downloaded from the same untrusted mutable source during setup.