← skillsmith scanner · all guides

Dependency Risk in Agent Skills: What OSV Teaches Us

Guide · skillsmith.ch

Modern agent skills rarely live alone. They reference scripts, install steps, pinned packages, or entire tool ecosystems. Every dependency is a supply-chain decision you inherit — and the OSSF OSV database (osv.dev) exists because those decisions go wrong constantly.

The three dependency surfaces of a SKILL.md

1. Explicit installs: "run pip install some-helper" inside instructions. The agent may execute this with your user's permissions, against whatever some-helper resolves to that day.
2. Pinned remotes: raw.githubusercontent URLs, CDN scripts, release tarballs. A pin to a tag is only as stable as the tag owner.
3. Implied trust: a skill that says "use my companion CLI" pulls in an entire second package you never reviewed.

What OSV data changes about review

OSV aggregates known vulnerabilities from GitHub Security Advisories, PyPI, npm and more, queryable by package or by commit hash. For skill review it adds two checks keyword scanning can't do:

• Version reality check: if a skill pins requests==2.2.1, OSV tells you in seconds that this version carries known CVEs — information no amount of reading the SKILL.md reveals.
• Commit-level exposure: for pinned commit hashes, OSV's Git ecosystem lets you check whether the pinned code predates a known fix.

How skillsmith uses it

The detection engine extracts candidate dependencies from the skill text (import lines, install commands, pinned versions) and enriches them with OSV queries during analysis. A match appears as a dedicated finding — so a skill can be perfectly polite in its instructions and still get flagged because the exact version it drags in has a published vulnerability. This complements instruction-level detection: one looks at what the skill says, this looks at what it ships.

Practical review checklist for dependencies

• List every external name the skill mentions. Would you install each one yourself, today?
• Distrust unpinned installs: they silently track upstream — including a future hostile release.
• Distrust over-tight pins too: a two-year-old pin may be frozen before a security fix.
• Check the dependency against OSV (or let skillsmith do it during the scan).
• Remember transitive risk: your review target is the tree, not the root.

Keep reading

• Anatomy of a malicious SKILL.md
• Homoglyph attacks — when identical-looking names lie
• The five-minute audit checklist