T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned and Unaudited Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md:4`, `SKILL.md:58-64` **Vulnerability Type**: Unpinned third-party dependency and expanded transitive dependency surface **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🏯","requires":{"bins":["japanfinance-agent"]},"install":[{"id":"uv","kind":"uv","package":"japanfinance-agent[all]","bins":["japanfinance-agent"],"label":"Install japanfinance-agent with all data sources (uv)"}],"tags":["japan","finance","mcp","agent","edinet","tdnet","estat","boj","stock","compound-analysis"]}} ``` ```bash # Install with all data sources pip install "japanfinance-agent[all]" # Or pick specific sources pip install "japanfinance-agent[edinet,tdnet,news]" ``` ### Technical Analysis The Skill instructs its host or user to install `japanfinance-agent` without an exact version, package hash, lockfile, or verifiable source reference. Dependency resolution therefore selects whichever compatible release is available from the configured package index at installation time. The default metadata installs the `[all]` extra, expanding the trust boundary to an unspecified collection of optional and transitive dependencies. None of the package or dependency implementations are included in the audited project, which contains only `SKILL.md`. Consequently, the audit cannot verify their installation behavior, network destinations, credential handling, MCP server behavior, or runtime command execution. This creates a supply-chain risk: a compromised package release, compromised transitive dependency, dependency-resolution attack, or malicious package served by an untrusted configured index could introduce arbitrary behavior that was not present during review. ### Attack Path 1. A user or Agent framework loads the Skill and processes its installation metadata, or the user follows the documented `pip install` command. 2. `uv` or `pip` resolves the unpinned `japanfi ...[truncated 1505 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `japanfinance-agent` to an exact, reviewed version in both installation metadata and documentation. 2. Use a lockfile that records every direct and transitive dependency. 3. Require cryptographic hashes for downloaded distributions, such as through pip's hash-checking mode. 4. Document the authoritative source repository and verify that published distributions correspond to reviewed source and release tags. 5. Avoid installing `[all]` by default. Enable only the minimum extras required for the intended use case. 6. Audit all direct and transitive dependencies before approving package updates. 7. Use a trusted, controlled package index and prevent fallback to untrusted indexes. 8. Run the CLI and MCP server in a restricted environment with least-privilege filesystem access, narrowly scoped credentials, and network allowlisting. 9. Keep financial-service credentials isolated from unrelated dependencies and avoid exposing them globally in the process environment. 10. Include the executable source in the reviewed artifact or provide reproducible-build provenance so its behavior can be independently verified.