T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:116
- Finding
- Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–18 and 116–120 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: gigamail kind: pip package: "gigamail[all]" bins: - gigamail-server - gigamail ``` ```bash pip install "gigamail[all]" ``` ### Technical Analysis The Skill directs users and the OpenClaw installation mechanism to install `gigamail[all]` without an exact version, a dependency lock file, cryptographic hashes, or another integrity-verification mechanism. Although the document states that GigaMail version 0.2.4 or later is required and identifies 0.3.2 as the current server release, the installation declarations do not enforce either version. The resolved package and its transitive dependencies can therefore change after this Skill has been audited. Installing an unpinned Python package may execute package-controlled installation logic and later exposes the installed server as an MCP process. The external package is expected to access sensitive email, calendar, attachment, identity, and knowledge-file data. Because the server implementation is not included in this project, its claimed approval controls cannot be independently verified from the audited artifact. ### Attack Path 1. An attacker compromises the package-index account, publishes a malicious future release, or compromises a transitive dependency selected by the unrestricted resolver. 2. A user follows the documented `pip install "gigamail[all]"` command, or the Skill installer processes the equivalent package declaration. 3. The package manager downloads and installs the attacker-controlled release or dependency. 4. Malicious code executes during installation or when `gigamail-server` is launched. 5. The installed server is registered as an MCP service and receives access to the configured mailbox, calendar, attachments, identity information, or knowledge files. 6. T ...[truncated 1124 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact, reviewed release in both installation locations, for example: ```yaml package: "gigamail[all]==0.3.2" ``` ```bash pip install "gigamail[all]==0.3.2" ``` 2. Generate and publish a lock file that pins every transitive dependency rather than only the top-level package. 3. Require cryptographic hashes during installation, such as: ```bash pip install --require-hashes -r requirements.lock ``` 4. Ensure that the package version declared in OpenClaw metadata matches the version documented as tested. 5. Publish signed release artifacts or checksums through a trusted channel and document how users should verify them. 6. Review dependency updates before changing the pinned version, including package provenance, maintainer changes, installation hooks, and transitive dependency differences. 7. Run the MCP server with least privilege and isolate it from unrelated credentials and files so that a compromised dependency has a limited impact. ]]>