T08 · Insecure Dependencies
Error
- Location
- SKILL.md:45
- Finding
- Untrusted Remote Skill Installation Without Security Validation## Vulnerability Details **File Location**: `SKILL.md`, lines 45–61 **Vulnerability Type**: Supply-chain exposure through unverified third-party Skill installation **Risk Level**: High ### Vulnerable Code ```markdown Returns the skill metadata and all file contents: - SKILL.md (main instructions) - Reference documentation - Helper scripts - Configuration files ## How to Install a Skill When the user asks to install a skill: 1. Call `get_skill` to retrieve all files 2. Create the directory `.claude/skills/{slug}/` 3. Save each file to the appropriate location: - `SKILL.md` → `.claude/skills/{slug}/SKILL.md` - Other files → `.claude/skills/{slug}/{filename}` 4. Read back `SKILL.md` to verify the frontmatter is intact ``` ### Technical Analysis The workflow retrieves registry-controlled files—including agent instructions, helper scripts, and configuration—and places them directly in `.claude/skills/`, an Agent Skill loading location. It does not require publisher authentication, cryptographic integrity verification, an allowlist, static analysis, script review, or a complete user preview before installation. Reading back `SKILL.md` and checking that its frontmatter remains intact verifies only file presence or formatting; it does not establish that the retrieved content is trustworthy. A malicious publisher or compromised registry entry could therefore distribute prompt-injection instructions or executable helper scripts through this installation workflow. No malicious payload exists in the audited package itself. The vulnerability is that it creates an unsafe third-party component installation path. ### Attack Path 1. An attacker publishes a malicious Skill to the external registry or compromises an existing registry entry. 2. The attacker places harmful agent instructions, helper scripts, or configuration in the Skill package. 3. A user searches for and selects that Skill. 4. The workflow invokes `get_skill` and receives the attacker-controlled ...[truncated 836 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation after displaying the complete file manifest, publisher identity, and security-relevant contents. 2. Authenticate the registry and publisher, and verify a cryptographic signature or pinned digest for every downloaded file. 3. Restrict installation to approved registries and trusted publisher allowlists. 4. Download packages into a quarantine directory rather than directly into `.claude/skills/`. 5. Scan all instruction files for prompt-injection patterns and inspect scripts for dangerous commands, network access, credential access, persistence, and destructive operations. 6. Warn separately when a package contains executable files and require additional confirmation before enabling them. 7. Apply least-privilege sandboxing when installed Skills or helper scripts are used. 8. Record package provenance, version, hashes, publisher, and review status to support later verification and revocation. 9. Treat frontmatter validation as a formatting check only, not as a security control.