T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md:4` and `SKILL.md:89` **Vulnerability Type**: Unpinned and externally resolved dependency **Risk Level**: Medium The Skill declares and recommends installation of the `edinet-mcp` package without constraining it to a reviewed version or verifying its integrity. **Complete code snippets:** `SKILL.md:4` ```yaml metadata: {"openclaw":{"emoji":"📊","requires":{"bins":["edinet-mcp"],"env":["EDINET_API_KEY"]},"install":[{"id":"uv","kind":"uv","package":"edinet-mcp","bins":["edinet-mcp"],"label":"Install edinet-mcp (uv)"}],"tags":["japan","finance","edinet","xbrl","financial-statements","mcp","securities","disclosure"]}} ``` `SKILL.md:89` ```markdown - Python package: `pip install edinet-mcp` or `uv tool install edinet-mcp` ``` ### Technical Analysis Both installation mechanisms resolve the current package associated with the `edinet-mcp` name from an external package source. The Skill does not specify an exact version, package hash, trusted repository, or immutable source revision. The project also contains no corresponding executable source code that would allow the installed implementation to be audited as part of this review. Consequently, the effective code installed by these instructions can change after the Skill has been reviewed. If the package's publishing account, distribution channel, or a future package release is compromised, installation or invocation could execute attacker-controlled code. Python packages may execute code through build or installation mechanisms, while the resulting CLI executes with the invoking user's privileges. ### Attack Path 1. An attacker compromises the upstream package, its maintainer account, or its distribution process and publishes a malicious release under the expected package name. 2. A user or agent follows the Skill metadata or setup instructions and runs `pip install edinet-mcp` or `uv tool install edinet-mcp`. 3. Bec ...[truncated 1042 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `edinet-mcp` to a specific version that has been reviewed, rather than resolving the latest available release. 2. Require cryptographic hashes for downloaded distributions, such as through a hash-locked requirements file or an equivalent verified installation workflow. 3. Explicitly identify the approved package index and official source repository to reduce dependency-confusion and source-substitution risk. 4. Prefer an immutable source revision or vendor the reviewed dependency when reproducible auditing is required. 5. Review the package's source, build configuration, installation hooks, transitive dependencies, and published artifacts before approving a version. 6. Perform installation in a least-privileged isolated environment, and avoid exposing `EDINET_API_KEY` or unrelated credentials during installation. 7. Add automated dependency monitoring and require security review before updating the pinned version.