Untrusted Package or Skill Installation

How the attack works

An attacker (or a compromised agent workflow) points a package manager or skill-install command at a direct URL, a GitHub repo, or a tarball archive instead of a signed registry entry. The installer fetches and runs whatever is at that location without the checks a registry applies. In agent frameworks like OpenClaw, this shows up as fetching a remote 'skill' definition by URL and loading it directly. The fetched code or definition then runs with the same privileges as the legitimate package or skill would have.

Netzilo detection

Why it matters

An organisation can end up executing attacker-controlled code inside its build, runtime, or agent environment, leading to backdoors, data theft, or further compromise through a poisoned dependency or skill.

What you can do

• →Restrict package managers and agent frameworks to pull only from approved internal or vetted public registries.
• →Block or closely review any install command that references a raw URL, GitHub link, or tarball archive.
• →Require code review and checksum/signature verification before adding new dependencies or skill definitions, even for internal registries served over plain HTTP.
• →Maintain an allowlist of approved sources and alert on installs from anything outside it, while excluding known dev workflows that legitimately pull pre-release packages from GitHub.

Known benign look-alikes

• Legitimate package installation from GitHub during development (e.g. pre-release packages)
• Authorised custom package installations from internal registries served over HTTP

References

• https://attack.mitre.org/techniques/T1195/
• https://blog.trailofbits.com/2025/01/09/the-risks-of-mcp-and-ai-tool-ecosystems/
• https://arxiv.org/abs/2403.04783

Related threats