T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:11
- Finding
- Unpinned Third-Party Package and Plugin Installation## Vulnerability Details **File Location**: `SKILL.md:11-13`; `references/hosts.md:6-7`, `references/hosts.md:15-16`, and `references/hosts.md:35-36` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:11-13`: ```markdown - Prefer `pip install "mnemos-memory[mcp]"` and `mnemos ui`. - For OpenClaw / ClawHub, teach the agent to self-install `mnemos-memory[mcp]`, run `mnemos ui`, then wire `mnemos-mcp` to the canonical `MNEMOS_CONFIG_PATH` before relying on memory. - Recommend SQLite as the supported persistent store. ``` `references/hosts.md:6-7`: ```bash pip install "mnemos-memory[mcp]" mnemos ui ``` `references/hosts.md:15-16`: ```bash pip install "mnemos-memory[mcp]" mnemos ui ``` `references/hosts.md:35-36`: ```text /plugin marketplace add anthony-maio/mnemos /plugin install mnemos-memory@mnemos-marketplace ``` ### Technical Analysis The Skill instructs users or agents to install an executable Python package and a marketplace plugin without pinning a reviewed version, commit, artifact digest, or package hash. Consequently, the installed content may differ from the content that existed when this Skill was audited. Python package installation can execute dependency-controlled build or installation logic and installs executable commands that are subsequently invoked as `mnemos`, `mnemos-cli`, and `mnemos-mcp`. The optional `mcp` dependency group can also introduce transitive dependencies whose versions are not constrained in this Skill. Similarly, adding a mutable plugin marketplace and installing a plugin by name does not establish an immutable trust boundary. The self-installation recommendation for OpenClaw and ClawHub increases the risk because an agent may initiate installation without a human independently reviewing the resolved package version and dependency tree. There is no evidence that the currently referenced pa ...[truncated 1633 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the Python package to a specific reviewed version, for example: ```bash python -m pip install "mnemos-memory[mcp]==<reviewed-version>" ``` 2. Maintain a lock file that constrains all transitive dependencies, not only the top-level package. 3. Require package hashes with `pip --require-hashes` or install a verified artifact whose SHA-256 digest is documented. 4. Pin marketplace content to a reviewed release tag or commit digest instead of relying on a mutable repository or plugin name. 5. Document the authoritative package registry, publisher identity, source repository, and release-signing or provenance verification procedure. 6. Require explicit user approval before an agent installs packages or plugins, especially during self-bootstrap flows. 7. Perform installation in an isolated virtual environment or container with least-privilege filesystem and network access. 8. Review dependency changes before upgrades and run vulnerability, provenance, and malware checks against the fully resolved dependency set. 9. Separate installation from execution so users can inspect the selected version and resolved artifacts before launching `mnemos`, `mnemos-cli`, or `mnemos-mcp`.