T08 · Insecure Dependencies
- Location
SKILL.md:81- Finding
Mandatory Invocation of Unpinned External Skills
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:81SKILL.md:138SKILL.md:234references/quality.md:23
Vulnerability Type: T08: Insecure Dependencies
Risk Level: MediumVulnerable Code Snippets
From
SKILL.md:81:markdown - 若触发深度研究：优先调用 `deep-research-pro` 生成多源研究摘要，来源建议 10-25 条，并在正文关键断言处写明来源链接From
SKILL.md:138:markdown 触发后：先调用 `deep-research-pro` 产出多源研究报告，保存到 `01_research.md`（包含来源链接清单与关键信息），再进入下方的常规搜索与选题流程。From
SKILL.md:234:markdown - 先调用 `content-humanizer-zh` 对 `04_draft.md` 做一轮人味化改写，再进入手工审校From
references/quality.md:23:markdown - [ ] 去 AI 味：先调用 `content-humanizer-zh` 做一轮人味化改写，再手工替换 AI 腔套话Technical Analysis
The Skill delegates parts of its workflow to two external Skills,
deep-research-proandcontent-humanizer-zh. Their source, immutable version, integrity hash, publisher identity, permission boundaries, and data-handling behavior are not defined by the audited project.The calls are mandatory when their corresponding workflow conditions are met. In particular,
content-humanizer-zhis instructed to process04_draft.md, which may contain unpublished or user-provided material. The invoking Agent must therefore trust dependency-controlled instructions while also exposing draft content to the dependency.This creates a supply-chain trust boundary that cannot be verified from the repository. Name collision, dependency replacement, account compromise, or a malicious dependency update could cause the Agent to execute instructions that were absent during this audit. No evidence establishes that either named dependency is currently malicious; the vulnerability is the unpinned and unverified delegation mechanism.
Attack Path
- An attacker publishes, replaces, or compromises a Skill available under the name
deep-research-proorcontent-humanizer-zh. - A user invokes a workflow involving deep research or article review.
- The audited Skill instructs the Agent ...[truncated 1303 chars]
- Remediation
View remediation
Remediation Suggestions
- Vendor the required dependency instructions into the project and audit them with the main Skill.
- If external dependencies remain necessary, pin each one to an immutable version, revision, or cryptographic digest.
- Verify publisher identity and dependency integrity before every invocation.
- Define an explicit capability policy for each dependency:
- Permit only the specific input file or research query required.
- Deny access to unrelated workspace files and credentials.
- Disable shell execution unless it is demonstrably necessary.
- Restrict network access to an allowlist where feasible.
- Limit writes to a dedicated per-run directory.
- Require explicit user consent before sending unpublished drafts to an external Skill.
- Treat dependency output as untrusted data rather than authoritative instructions. Do not permit it to override system, user, or parent-Skill constraints.
- Add a local fallback that performs research summarization or language editing without invoking external Skills.
- Record the dependency version, permissions, input files, and output files in each run log to support review and incident response.
- Document retention and deletion controls for
04_draft.md, research files, and other potentially sensitive artifacts.