AST02: Supply Chain Compromise
Risk Level: Critical
Skill registries generally lack the provenance controls that mature package ecosystems built over a decade: signed releases, transparency logs, immutable version pinning. The result is typosquatting, registry poisoning, and dependency hijacking against a distribution channel that agents install from automatically.
The sharper problem is that repository configuration files, once passive metadata, are now execution paths. Opening a cloned repository can run code before any consent dialog appears.
Real-world evidence
The project cites CVE-2025-59536 and CVE-2026-21852 against Claude Code, where repository files triggered code execution before the startup trust dialog and allowed a malicious repo to exfiltrate API keys through a settings override. NVD rates them 8.8 High and 7.5 High respectively (CVSS 3.1); the GitHub CNA's secondary CVSS 4.0 scores are lower, at 8.7 and 5.3. Cloning a repository was enough to trigger them.
Mitigations
- Pin nested dependencies to immutable content hashes, never to version ranges
- Require verified code-signing identities and transparency logs for registry operations
- Treat repository configuration files as executable code in your threat model, because they are
- Scan recursive dependency trees, not just the top-level skill manifest
- Run an internal skill mirror for enterprise deployments instead of installing from public registries
- Open untrusted repositories in a container, not on the host that holds your credentials