T08 · Insecure Dependencies
- Location
SKILL.md:30- Finding
Unverified Automatic Installation and Loading of an External Skill Dependency
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 30-36 and 52
Vulnerability Type: Supply-chain risk caused by automatic dependency installation
Risk Level: MediumVulnerable Code Snippet
markdown ## 依赖声明 本技能**强依赖** Universal Task OS (universal-task-os)。没有UTOS，本技能只有参考查阅能力，无法执行任何写作产出任务。 **加载检查流程**（每次激活时执行）： 1. 检测 `universal-task-os` 技能是否已安装 2. **未安装** → 自动安装 `universal-task-os` 技能 3. **安装成功** → 同时加载UTOS，按本技能"使用规则"执行markdown 1. **依赖检查**：激活时按上述流程检测并安装UTOSTechnical Analysis
The Skill directs the Agent to install
universal-task-osautomatically whenever that dependency is absent and then load it into the active session. However, the instructions do not identify a trusted registry, approved publisher, immutable version, cryptographic digest, signature, or verification procedure. They also do not require informed user confirmation before installation.This creates an unsafe supply-chain boundary: the effective behavior of the audited Skill depends on content resolved outside this repository at activation time. An attacker able to influence dependency resolution could publish or substitute a package under the expected name. A legitimate dependency could also be compromised or changed after this Skill has been reviewed.
The repository contains no implementation of the installer, so no specific command-injection or repository-compromise mechanism can be confirmed. The confirmed weakness is the instruction to perform automatic, unverified installation and loading.
Attack Path
- A user activates the Skill on a system where
universal-task-osis not installed. - The activation procedure detects that the dependency is absent.
- Following
SKILL.md, the Agent automatically resolves and installs a package nameduniversal-task-os. - Because no trusted source, publisher identity, version, digest, or signature is required, a malicious or compromised component may satisfy that dependency.
- The newly installed ...[truncated 811 chars]
- A user activates the Skill on a system where
- Remediation
View remediation
Remediation Suggestions
- Remove automatic installation from the activation path and default to the documented read-only mode when the dependency is unavailable.
- Require explicit user approval before installing or loading any external skill.
- Resolve the dependency exclusively from a documented, allowlisted registry and verify the expected publisher identity.
- Pin an immutable dependency version rather than resolving the latest package by name.
- Verify a cryptographic digest or trusted digital signature before installation and again before loading.
- Record the verified source, version, digest, and requested permissions in an auditable lock file or manifest.
- Apply least privilege to the dependency, denying filesystem, network, credential, and process-execution access unless individually required and approved.
- Treat verification failure as a hard failure: do not install the component and continue only in local read-only reference mode.
- Review and test each dependency update before changing the pinned version.