T08 · Insecure Dependencies
- Location
SKILL.md:27- Finding
Automatic Installation of an Unverified External Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 27–35
Vulnerability Type: Unverified automatic dependency installation
Risk Level: MediumVulnerable Code Snippet
markdown ## 依赖声明 本技能**强依赖** Universal Task OS (universal-task-os)。没有UTOS，本技能只有参考查阅能力，无法执行任何自媒体运营任务。 **加载检查流程**（每次激活时执行）： 1. 检测 `universal-task-os` 技能是否已安装 2. **未安装** → 自动安装 `universal-task-os` 技能 3. **安装成功** → 同时加载UTOS，按本技能"使用规则"执行 4. **安装失败** → 降级为**只读参考模式**：The same behavior is reinforced at
SKILL.md:47:markdown 1. **依赖检查**：激活时按上述流程检测并安装UTOSTechnical Analysis
The Skill instructs the Agent to install and load
universal-task-osautomatically whenever that dependency is absent. The dependency is identified only by a mutable name. The instructions do not define:- An authoritative registry or repository
- A verified publisher identity
- A pinned version or immutable commit
- A cryptographic checksum or signature
- A review step before loading
- Explicit user authorization before installation
Consequently, dependency resolution may select a malicious or compromised component through dependency confusion, name takeover, registry compromise, or publisher compromise. Loading the resulting Skill would introduce instructions and potentially executable behavior that were not part of this audited package.
The project itself contains no dependency-fetching script or embedded malicious payload. The vulnerability is the unsafe installation directive and trust model, not evidence that the named dependency is currently malicious.
Attack Path
- An attacker publishes, replaces, or compromises a component resolvable under the name
universal-task-os. - A user activates this Skill in an environment where that dependency is not installed.
- The loading workflow follows
SKILL.mdand automatically resolves and installs the dependency without requesting user approval. - No source, publisher, version, signature, or checksum is available to distinguish ...[truncated 1091 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic installation during Skill activation. If the dependency is absent, use read-only mode by default.
- Require explicit, informed user approval before retrieving or installing any external Skill.
- Identify the dependency using an authoritative registry or repository URL and a verified publisher identity.
- Pin an immutable release version or source commit rather than resolving only the name
universal-task-os. - Publish and verify a cryptographic checksum or signature before installation.
- Inspect the dependency manifest, instructions, scripts, requested permissions, and transitive dependencies before loading it.
- Apply least privilege by denying network, filesystem, shell, credential, and persistence capabilities unless they are specifically necessary.
- Fail closed when provenance or integrity verification fails; do not load an unresolved or mismatched dependency.
- Record the resolved source, version, digest, approval decision, and installation result in an audit log.
- Prefer a separately documented manual installation procedure over activation-triggered installation.