T08 · Insecure Dependencies
Warning
- Location
SKILL.md:326- Finding
Unpinned dependency installation from a mutable Git repository
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:326-327
Vulnerability Type: Unpinned third-party dependency from a mutable source
Risk Level: MediumVulnerable Code
text For gRPC, use the [FinamPy](https://github.com/cia76/FinamPy) Python library ( `pip install git+https://github.com/cia76/FinamPy.git`).The same unsafe installation command also appears in
references/GRPC.md:7-10:bash ## Installation ```bash pip install git+https://github.com/cia76/FinamPy.gittext ### Technical Analysis The installation command retrieves FinamPy from the repository's mutable default branch. It does not specify an immutable commit, signed release, exact package version, lock file, or integrity hash. Package installation may execute build backend and installation logic on the user's system. Consequently, later upstream changes can alter the effective code executed by users without requiring any modification to this Skill. Repository compromise, malicious maintainer changes, or an account takeover could turn this documented installation command into a remote code-execution and credential-theft channel. The exposure is especially significant because `references/GRPC.md:12-24` instructs users to provide `FINAM_API_KEY` to the installed library and states that the credential is stored in the system credential store: ```python import os from FinamPy import FinamPy fp_provider = FinamPy(os.environ["FINAM_API_KEY"])Subsequent construction without an explicit token indicates that the dependency can retrieve the stored credential:
python fp_provider = FinamPy()There is no evidence that the currently referenced repository is malicious. The vulnerability is the lack of immutable dependency pinning and integrity verification.
Attack Path
- An attacker compromises the FinamPy repository, a maintainer account, or its mutable default branch.
- The attacker adds ma ...[truncated 1487 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the mutable Git installation with an exact, reviewed release from a trusted package registry where possible.
- Pin the dependency to an immutable version and verify package hashes, for example through a lock file and
pip --require-hashes. - If Git installation is unavoidable, pin a reviewed full commit hash rather than a branch or tag:
bash pip install "git+https://github.com/cia76/FinamPy.git@FULL_REVIEWED_COMMIT_HASH" - Verify release signatures or provenance attestations where supported.
- Install the dependency in an isolated virtual environment under a non-privileged account; never run pip as root for this Skill.
- Review the pinned dependency's build configuration, initialization behavior, network destinations, and credential-storage implementation.
- Use a restricted Finam credential with only the minimum required capabilities where the API supports scoped credentials.
- Document how users can revoke the Finam key and remove credentials stored by FinamPy.
- Apply the same corrected installation guidance in both
SKILL.mdandreferences/GRPC.mdto avoid leaving an unsafe alternative.