T08 · Insecure Dependencies
Warning
- Location
SKILL.md:8- Finding
Execution of an Unverified External Validation Script
- Content
View full analysis
/.groundcrew/groundcrew-doctor.py --evidence ` before using them in a conclusion. Output follows `references/reporting.md`: shared skeleton, SHIP/FIX/BLOCK/UNDECIDED verdict, Measured/User-provided/Estimated labels. ``` ### Technical Analysis The Skill instructs the Agent to locate and execute `groundcrew-doctor.py` from an external “active skills root.” That script is not included in the audited project, and the instruction does not define a fixed trusted path, expected cryptographic digest, signature, version, file owner, or permission requirements. Because discovery of the active skills root is ambiguous, path resolution may select a directory writable or otherwise controlled by an attacker. A malicious file placed at `.groundcrew/groundcrew-doctor.py` could consequently be treated as the legitimate validator and executed. The evidence-record argument does not mitigate this risk because Python executes the script itself before any validation behavior can be trusted. This is a supply-chain trust failure: security-sensitive execution is delegated to a component whose contents and provenance cannot be verified from the audited package. ### Attack Path 1. An attacker obtains write access to a directory that the Agent may identify as the active skills root. 2. The attacker creates or replaces `/.groundcrew/groundcrew-doctor.py` with a malicious Python program. 3. A user invokes the weekly-report Skill with evidence to process. 4. Following `SK ...[truncated 1227 chars]- Remediation
View remediation