T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:38- Finding
Unnecessary Global Modification of the Homebrew curl Environment
- Content
View full analysis
⚠️ **Please ask for human permission before executing `brew unlink curl -v`.** If the human is unsure, recommend executing it (to resolve the potential conflict). ``` ### Technical Analysis The Skill is intended to perform PDF inspection, extraction, conversion, merging, splitting, attachment management, and signature verification through Poppler utilities. None of these functions inherently requires unlinking the globally installed Homebrew version of `curl`. The documented command changes Homebrew's global executable links and can consequently alter which `curl` binary is selected by the shell. Although the instructions require human permission, they also direct the agent to recommend execution when the user is uncertain. This encourages a system-wide configuration change without first confirming that a conflict exists. This exceeds the minimum system modification required for the declared PDF functionality. It may also create inconsistent TLS, certificate, or feature behavior if unrelated applications subsequently resolve a different `curl` implementation. ### Attack Path 1. A user loads the Skill to perform an ordinary local PDF operation. 2. The Skill recommends running `brew unlink curl -v` before Poppler is used. 3. The user grants permission without an actual curl conflict having been diagnosed, potentially because the Skill r ...[truncated 1480 chars]- Remediation
View remediation