# Untrusted Package or Skill Installation

- **Severity:** High
- **Signature ID:** `8f715d20-5097-5a36-810f-5c8b9652a17b`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain), ASI08 (Supply Chain Attacks on Agent Ecosystems)

## Summary

This detects when a system or an AI agent installs a package, dependency, or 'skill' definition directly from a raw URL, GitHub link, or tarball archive rather than from an official package registry. That bypass skips the vetting and version integrity checks a registry normally provides, making it easier to slip in malicious code.

## How the attack works

An attacker (or a compromised agent workflow) points a package manager or skill-install command at a direct URL, a GitHub repo, or a tarball archive instead of a signed registry entry. The installer fetches and runs whatever is at that location without the checks a registry applies. In agent frameworks like OpenClaw, this shows up as fetching a remote 'skill' definition by URL and loading it directly. The fetched code or definition then runs with the same privileges as the legitimate package or skill would have.

## Why it matters

An organisation can end up executing attacker-controlled code inside its build, runtime, or agent environment, leading to backdoors, data theft, or further compromise through a poisoned dependency or skill.

## What you can do

- Restrict package managers and agent frameworks to pull only from approved internal or vetted public registries.
- Block or closely review any install command that references a raw URL, GitHub link, or tarball archive.
- Require code review and checksum/signature verification before adding new dependencies or skill definitions, even for internal registries served over plain HTTP.
- Maintain an allowlist of approved sources and alert on installs from anything outside it, while excluding known dev workflows that legitimately pull pre-release packages from GitHub.

## Known benign look-alikes

- Legitimate package installation from GitHub during development (e.g. pre-release packages)
- Authorised custom package installations from internal registries served over HTTP

## References

- https://attack.mitre.org/techniques/T1195/
- https://blog.trailofbits.com/2025/01/09/the-risks-of-mcp-and-ai-tool-ecosystems/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/untrusted-skill-install