T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:890
- Finding
- Unpinned Third-Party Security Tools and Mutable Container Image<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:445-446, 890, 895, 898, 925-926`; `references/git-credential-safety.md:140-143, 181-182` **Vulnerability Type**: Unsafe supply-chain dependency resolution **Risk Level**: Medium ### Complete Code Snippets From `SKILL.md`: ```bash pip-audit # pip install pip-audit first safety check # Alternative: pip install safety ``` ```bash pip install detect-secrets ``` ```bash docker run --rm -v "$(pwd):/repo" zricethezav/gitleaks:latest detect --source /repo ``` ```bash pip install trufflehog ``` ```bash pip install pre-commit pre-commit install # Hooks run automatically on git commit from now on ``` From `references/git-credential-safety.md`: ```markdown | **detect-secrets** | `pip install detect-secrets` | `detect-secrets scan .` | Baseline-based, reduces noise over time | | **truffleHog** | `pip install trufflehog` | `trufflehog filesystem .` | High-entropy detection + git history scan | | **semgrep** | `pip install semgrep` | `semgrep --config=p/secrets .` | SAST + secrets, highly configurable | ``` ```bash pip install pre-commit pre-commit install # Now runs automatically on every git commit ``` ### Technical Analysis The skill recommends installing security tools without exact version or hash constraints. Package managers therefore resolve whichever release is current when the instruction is followed. If an upstream project, maintainer account, distribution artifact, or package registry is compromised, a future malicious release could execute with the invoking user's privileges. The gitleaks example uses the mutable `latest` image tag and mounts the current repository at `/repo`. Because no immutable digest is specified, the image contents can change after the skill has been reviewed. The repository mount is not declared read-only, so code inside the image may read or modify project files. Running `pre-commit install` also ...[truncated 2287 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every Python security tool to an exact, reviewed version: ```text detect-secrets==<reviewed-version> --hash=sha256:<verified-hash> trufflehog==<reviewed-version> --hash=sha256:<verified-hash> pre-commit==<reviewed-version> --hash=sha256:<verified-hash> ``` 2. Store these constraints in a dedicated requirements file and install with hash enforcement: ```bash python -m venv .security-tools-venv . .security-tools-venv/bin/activate python -m pip install --require-hashes -r security-tools-requirements.txt ``` 3. Replace the mutable container tag with a verified immutable digest and mount the repository read-only: ```bash docker run --rm \ --network none \ -v "$(pwd):/repo:ro" \ zricethezav/gitleaks@sha256:<verified-digest> \ detect --source /repo ``` 4. Verify package provenance, release signatures, hashes, maintainers, and source repositories before installation. 5. Run scanners in an isolated environment without cloud credentials, SSH agents, secret-bearing environment variables, or unnecessary network access. 6. Pin every pre-commit hook revision to a reviewed immutable commit SHA rather than a mutable tag. Review the generated hook configuration before running `pre-commit install`. 7. Separate tool installation from routine scanning. Installation or upgrades should require explicit approval and review, while routine scans should reuse already verified artifacts. 8. Update both `SKILL.md` and `references/git-credential-safety.md` so all examples consistently follow the skill's stated dependency-pinning policy. ]]>