T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Third-Party Package Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:39-41` and `README.md:32-34` **Vulnerability Type**: Unpinned dependency execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:39-41`: ```bash uv tool run fulcra-api --help uv tool run fulcra-api auth login --get-auth-url uv tool run fulcra-api user-info ``` The same commands are duplicated in `README.md:32-34`: ```bash uv tool run fulcra-api --help uv tool run fulcra-api auth login --get-auth-url uv tool run fulcra-api user-info ``` ### Technical Analysis The documented setup commands instruct users to resolve and execute the `fulcra-api` package without specifying an audited version, an artifact hash, or a verified package source. The repository also provides no lockfile or vendored artifact that constrains which package release will be executed. `uv tool run` can acquire the package from the configured package index and then invoke its executable. Consequently, the code executed by these instructions can change after this skill has been reviewed. A compromised publisher account, package-index compromise, malicious configured index, or compromised future release could cause arbitrary package code to run locally. Merely invoking `--help` does not provide a security boundary: package installation, module initialization, and command entry-point loading may execute package-controlled code before help output is displayed. ### Attack Path 1. An attacker compromises the package publisher, distribution channel, configured package index, or a future release of `fulcra-api`. 2. The attacker publishes a malicious package version under the name that the unpinned command resolves. 3. A user follows the setup instructions and executes `uv tool run fulcra-api --help` or one of the subsequent authentication commands. 4. `uv` resolves and installs the attacker-controlled release because no version or artifact integrity constraint is specified. 5. The ma ...[truncated 1066 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `fulcra-api` to a specific version that has undergone security review, for example: ```bash uv tool run 'fulcra-api==X.Y.Z' --help ``` 2. Identify and enforce the trusted package registry rather than relying on ambient package-index configuration. 3. Verify the downloaded artifact with a cryptographic hash or signature before execution. Where practical, distribute a reviewed wheel and install it from a controlled source with hash verification. 4. Maintain a lockfile or equivalent immutable dependency manifest covering `fulcra-api` and its transitive dependencies. 5. Test and review the exact pinned artifact before publishing setup instructions. 6. Run initial package verification in a restricted environment with minimal filesystem, credential, and network access. 7. Do not perform authentication until package provenance and integrity have been verified. 8. Apply the same corrected instructions to both `SKILL.md` and `README.md` to prevent users from following the unsafe duplicate.