T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned and Unverified Third-Party CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-21 **Vulnerability Type**: Supply-chain risk from unpinned and unverified external dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown Install - Homebrew (macOS/Linux): `brew tap aronjanosch/tap && brew install sparky-cli` - Build from source (requires Go 1.21+): ``` git clone https://github.com/aronjanosch/sparky-cli cd sparky-cli go build -o sparky . sudo mv sparky /usr/local/bin/ ``` - Pre-built binaries: https://github.com/aronjanosch/sparky-cli/releases (Linux, macOS, Windows — amd64/arm64) ``` ### Technical Analysis The installation instructions obtain and execute a third-party CLI without pinning it to an immutable commit or verified release. The documented methods use: - A custom Homebrew tap without a pinned formula version. - The current default branch of a Git repository. - Pre-built release binaries without checksum or signature verification. - A system-wide installation command using `sudo`. Consequently, the code reviewed by a user may differ from the code downloaded later. Compromise of the Homebrew tap, Git repository, maintainer account, default branch, release process, or hosted binary could result in attacker-controlled code being installed. This trust boundary is particularly sensitive because subsequent setup and usage give the `sparky` executable access to an API key and personal health information. The Skill homepage identifies `CodeWithCJ/SparkyFitness`, while the CLI is retrieved from an account named `aronjanosch`; the instructions do not document or verify the relationship between these parties. ### Attack Path 1. An attacker compromises the upstream Homebrew tap, CLI repository, maintainer account, release pipeline, or downloadable artifact. 2. The attacker modifies the formula, source repository, or release binary to include malicious code. 3. A user follows the documented installation instructions without checking an imm ...[truncated 1276 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin source installations to a reviewed release tag and immutable Git commit rather than cloning the current default branch. 2. Publish SHA-256 or stronger checksums for every pre-built artifact and require users to verify them before installation. 3. Cryptographically sign release artifacts and tags, and document signature verification commands. 4. Use provenance attestations, such as Sigstore or SLSA-compatible build provenance, to establish how release binaries were produced. 5. Pin the Homebrew formula or package version and document the trusted ownership relationship between the SparkyFitness project, CLI repository, and tap. 6. Avoid installing with `sudo` where possible. Prefer a user-owned executable directory such as `$HOME/.local/bin`. 7. If system-wide installation is necessary, verify the source revision and artifact integrity before moving the binary into `/usr/local/bin`. 8. Apply least privilege to the SparkyFitness API key, limiting it to only the operations required by the CLI. 9. Clearly document where credentials are stored, their filesystem permissions, and how users can rotate or revoke them. 10. Include the CLI source in the audit scope or provide a reproducible-build procedure so the installed binary can be matched to reviewed source code. ]]>