T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:99
- Finding
- Unpinned Automatically Downloaded Third-Party Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 99 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable snippet**: ```markdown - **Dependencies**: Requires Rerun SDK (auto-downloaded via `gettool`) ``` ### Technical Analysis The skill states that the Rerun SDK is automatically downloaded through `gettool`, but it does not specify an authoritative registry or source URL, an exact immutable version, a cryptographic hash, or a signature-verification procedure. Consequently, the dependency resolved at execution time may differ from the component that was originally reviewed. If the package source, resolution process, publisher account, or downloaded artifact is compromised, a malicious dependency could execute code during installation or subsequent import. The project itself contains no bundled executable scripts; this risk arises from the documented external dependency acquisition process. ### Attack Path 1. An attacker compromises or substitutes the dependency available through the source used by `gettool`, or otherwise influences resolution toward a malicious artifact. 2. A user follows the skill instructions and invokes functionality requiring the Rerun SDK. 3. `gettool` automatically retrieves the dependency without a documented immutable version or integrity check. 4. Malicious installation hooks or imported package code execute in the Agent's environment. 5. The payload operates with the permissions available to the Agent process. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the current Agent or user process privileges. Depending on that environment's permissions, the malicious component could access files, environment variables, network resources, or other data available to the process and could alter task results. The documentation does not establish privilege escalation, persistence, credential theft, or exfiltration b ...[truncated 68 chars]
- Remediation
- ## Remediation Suggestions 1. Identify and document the official package registry and publisher from which the Rerun SDK must be obtained. 2. Pin the dependency to an exact, reviewed version rather than resolving the latest available release automatically. 3. Verify downloaded artifacts using an approved cryptographic hash or publisher signature. 4. Generate and enforce a lockfile or hash-locked requirements file where supported. 5. Avoid implicit downloads during skill execution; require dependencies to be installed through a separate, reviewable setup step. 6. Perform installation in an isolated, least-privileged environment and prevent unnecessary access to secrets and sensitive files. 7. Review dependency updates before changing the pinned version and retain provenance information for the approved artifact.