T08 · Insecure Dependencies
- Location
SKILL.md:32- Finding
Automatic Installation and Loading of an Unpinned External Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 32–39
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
markdown **Loading check process** (execute on every activation): 1. Check whether the `universal-task-os` Skill is installed 2. **Not installed** → automatically install the `universal-task-os` Skill 3. **Installation succeeds** → load UTOS simultaneously and execute according to this Skill's usage rules 4. **Installation fails** → fall back to **read-only reference mode**: - ✅ Allowed: consult the document catalog, content requirements, and exemplar index - ❌ Refuse: any task involving document production, pipeline orchestration, or content generation, and state that Universal Task OS must be installed firstThe requirement is reiterated at
SKILL.md, line 52:markdown 1. **Dependency check**: when activated, follow the process above to check for and install UTOSTechnical Analysis
The Skill instructs the agent to install and immediately load the external
universal-task-osSkill whenever that dependency is absent. The dependency is identified only by a mutable package or Skill name. The instructions do not specify:- A trusted registry or repository
- An authenticated publisher identity
- An immutable version or commit
- A cryptographic checksum or signature
- A permission manifest
- A review or approval step
- User confirmation before installation and loading
This creates an unsafe software supply-chain boundary. Depending on how the hosting agent resolves Skill names, an attacker could exploit dependency confusion, namespace takeover, publisher compromise, or a malicious update. The newly installed dependency could then supply attacker-controlled instructions or executable components.
The audited project does not contain an installer command, download URL, or copy of the dependency. Therefore, this finding does not establish that the current `universal-task-os ...[truncated 1857 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic installation from the activation process. If the dependency is missing, use the existing read-only fallback and inform the user.
- Require explicit, informed user approval before installing any external Skill.
- Pin the dependency to:
- A specific trusted registry or repository
- A verified publisher identity
- An immutable release version or commit
- An expected cryptographic digest or verified signature
- Verify package provenance and integrity before installation and again before loading.
- Do not install and load a new dependency in the same activation. Require a separate review or restart boundary.
- Declare the dependency's required permissions and enforce least privilege through the host environment.
- Maintain an allowlist of approved dependency identifiers and reject name-only or ambiguous resolution.
- Record dependency resolution details, verification results, version, digest, and approval decisions in an audit log.
- Periodically review pinned versions for security updates, but do not permit silent or automatic upgrades.
- Prefer bundling a reviewed, immutable dependency when licensing and distribution constraints allow it.