T08 · Insecure Dependencies
- Location
SKILL.md:34- Finding
Automatic Installation and Loading of an Unverified External Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 34–39 and line 51
Vulnerability Type: Supply-chain risk through automatic installation of an unverified dependency
Risk Level: MediumVulnerable Code Snippet
markdown **加载检查流程**（每次激活时执行）： 1. 检测 `universal-task-os` 技能是否已安装 2. **未安装** → 自动安装 `universal-task-os` 技能 3. **安装成功** → 同时加载UTOS，按本技能"使用规则"执行 4. **安装失败** → 降级为**只读参考模式**：markdown 1. **依赖检查**：激活时按上述流程检测并安装UTOSTechnical Analysis
The Skill directs the Agent to install and load the external
universal-task-osSkill automatically whenever that dependency is absent. It does not specify:- A trusted registry or repository
- An authenticated publisher
- An immutable package version or commit
- A cryptographic checksum or signature
- A dependency review procedure
- Explicit user approval before installation
Consequently, the dependency name may be resolved through whichever package or Skill registry is available to the Agent. This creates a supply-chain trust transition in which instructions not included in the audited project can be installed and loaded into the Agent's execution context.
An attacker able to publish, substitute, or compromise the resolved dependency could supply malicious Skill instructions under the expected name. Because the dependency is loaded after installation, those instructions could influence subsequent Agent behavior and use any tools or permissions available in that environment.
Attack Path
- The user activates this Skill for a supported task.
- The Skill instructs the Agent to determine whether
universal-task-osis installed. - The dependency is absent.
- The Agent follows the automatic installation instruction.
- The unresolved package name is looked up through an available external registry or installation source.
- An attacker-controlled or compromised package is returned because the source, publisher, version, and integrity are not pinned.
- The Agent installs and l ...[truncated 889 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic dependency installation from Skill activation.
- Keep the Skill in read-only mode when the dependency is unavailable.
- Require explicit, informed user approval before any installation.
- Specify an authoritative HTTPS registry or repository and verify the publisher identity.
- Pin the dependency to an immutable version or commit rather than resolving only by name.
- Verify a cryptographic checksum or trusted digital signature before installation.
- Audit the pinned dependency's instructions and packaged code before loading it.
- Apply least privilege when loading the dependency, restricting filesystem, network, command-execution, and credential access to what the requested task requires.
- Fail closed if source, version, publisher, signature, or checksum verification cannot be completed.
- Record the resolved source, version, and integrity value in installation logs for traceability.