T08 · Insecure Dependencies
- Location
SKILL.md:30- Finding
Automatic Installation of an Unverified External Skill Dependency
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 30–36
Vulnerability Type: Unverified automatic dependency installation
Risk Level: MediumVulnerable Code Snippet
markdown ## 依赖声明 本技能**强依赖** Universal Task OS (universal-task-os)。没有UTOS，本技能只有参考查阅能力，无法执行任何短视频创作任务。 **加载检查流程**（每次激活时执行）： 1. 检测 `universal-task-os` 技能是否已安装 2. **未安装** → 自动安装 `universal-task-os` 技能 3. **安装成功** → 同时加载UTOS，按本技能"使用规则"执行 4. **安装失败** → 降级为**只读参考模式**：Technical Analysis
The Skill instructs the agent to automatically install and load an external Skill named
universal-task-oswhenever that dependency is absent. It does not specify a trusted registry, verified publisher, immutable version or commit, cryptographic checksum, signature-validation procedure, or explicit user-approval step.Resolving a mutable package name from an unspecified source creates a supply-chain risk. An attacker could exploit dependency confusion, namespace takeover, publisher compromise, or replacement of a mutable release to make the agent install attacker-controlled content. The external dependency and its installer are not included in this project, so their behavior could not be audited.
Although the project itself contains no executable scripts, loading the dependency may expose the agent to additional instructions or executable components supplied by that package.
Attack Path
- A user activates this Skill in an environment where
universal-task-osis not installed. - The loading procedure detects that the dependency is missing.
- Following
SKILL.md, the agent attempts to locate and automatically install a package identified only asuniversal-task-os. - An attacker publishes or compromises a package under the resolved name or distribution source.
- The agent installs and loads the attacker-controlled package without integrity verification or explicit user approval.
- The malicious dependency receives delegated tasks and can execute any instructions or cod ...[truncated 859 chars]
- A user activates this Skill in an environment where
- Remediation
View remediation
Remediation Suggestions
- Remove automatic installation from the activation flow and default to read-only mode when the dependency is unavailable.
- Require explicit, informed user approval before installing or loading any external Skill.
- Specify an allowlisted, trusted registry and verify the dependency publisher or namespace owner.
- Pin the dependency to an immutable version, release digest, or source-control commit rather than resolving a mutable name.
- Publish and validate a cryptographic checksum or signed provenance record before installation.
- Audit the pinned dependency and its transitive dependencies before allowing it to run.
- Install and execute the dependency with least privilege, restricting filesystem, network, credential, and tool access to what is necessary.
- Fail closed if source, publisher, version, signature, or integrity verification cannot be established.
- Record the resolved source, version, digest, approval event, and verification result in an installation audit log.