T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 14–15 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🖨️","requires":{"bins":["inkjet"],"bluetooth":true},"install":[{"id":"pip","kind":"pip","package":"inkjet","label":"Install (pip)"},{"id":"brew","kind":"brew","package":"aaronchartier/tap/inkjet","label":"Install (Homebrew)"}]}} ``` ```bash pip install inkjet # Universal brew install aaronchartier/tap/inkjet # macOS (takes longer, compiles Pillow) ``` ### Technical Analysis The skill instructs users or agents to install `inkjet` from PyPI or a third-party personal Homebrew tap without pinning a package version, immutable source revision, or integrity hash. Consequently, the installed software may differ from the version that existed when the skill was audited. Package installation can execute package-controlled build or installation logic. A malicious or compromised release could therefore run code under the installing user's account. The Homebrew option additionally relies on a third-party tap whose formula and referenced artifacts may be modified independently of this skill. This finding concerns dependency provenance and mutability. The reviewed file does not itself contain a malicious payload, and the audit did not establish that the current `inkjet` package or tap is malicious. ### Attack Path 1. An attacker compromises the relevant package publisher account, source repository, distribution infrastructure, or third-party Homebrew tap. 2. The attacker publishes a malicious `inkjet` release or changes the Homebrew formula or its referenced artifact. 3. A user or agent follows the documented unpinned installation command. 4. The package manager resolves the mutable package name to the attacker-controlled release. 5. Malicious build, installation, or runtime logic executes with the privileges of the user running the package ma ...[truncated 813 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version rather than installing the latest mutable release: ```bash python -m pip install "inkjet==<reviewed-version>" ``` 2. Require integrity verification, such as a locked requirements file containing cryptographic hashes: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Document the authoritative upstream repository and verify that the PyPI publisher, source repository, and expected package ownership correspond. 4. Prefer an official, trusted distribution channel. If the third-party Homebrew tap is necessary, pin or otherwise verify the formula revision and downloaded artifact checksum. 5. Review the pinned package's source, build configuration, transitive dependencies, and installation hooks before approving it for agent-controlled installation. 6. Perform installation and execution as an unprivileged user in an isolated environment, such as a dedicated Python virtual environment or sandbox. Do not use `sudo` for package installation. 7. Introduce an explicit dependency-update process so newer versions are reviewed and their pins and hashes are updated deliberately rather than being selected automatically at installation time. ]]>