SD-011 — Vulnerable Dependencies
SD-011 flags a dependency a skill installs from a URL, a git reference, or a raw GitHub script, rather than by name and version from a package registry.
What it matches
A dependency installed from a URL or a git reference rather than by name from a registry — the pip, npm and go install forms — or a reference to a raw GitHub script. No advisory database is consulted.
Why it matters
A registry name plus a version resolves to the same bytes for everyone, and those bytes can be mirrored, cached and checked against advisory data. A URL or a git reference resolves to whatever sits at that location now: a branch moves, a raw file link follows the default branch, and a host can serve different content to different callers. The dependency the skill's author reviewed and the one a user installs next month are then not the same code, and nothing in the skill records which one ran.
Example
bash
# Setup in SKILL.md: pip install https://files.example.com/packages/helper-0.1.tar.gz npm install github:example-org/helper-tool
Neither install names a registry package and a version, so neither resolves to fixed bytes.
How to fix it
Install by package name with an exact version from the language's registry, and commit a lockfile so a repeat install produces the same bytes. Where a fork or a patch is genuinely needed, publish it to the registry, or pin the git reference to an immutable commit SHA rather than a branch.
Known false positives
An install from a first-party URL or an internal git host, deliberate policy rather than an oversight. We cannot tell the two apart from the line alone.
Standards mapping
Prevalence
Pattern SD-011 was detected in 114 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.