T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:77
- Finding
- Unpinned and Unaudited Third-Party Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 77–78, 107–109, and 219 **Vulnerability Type**: Supply-chain exposure through mutable, unpinned dependencies **Risk Level**: Medium ### Vulnerable Code Snippets Lines 77–78: ```markdown | **pasm-skills** (base) | Provides capabilities only | `pip install pasm-skills` | | **pasm-agents** (skill source) | Companion agents and verifiers | `pip install pasm-agents` | ``` Lines 107–109: ```bash pip install pasm-agents # Source installation when PyPI is unavailable: # git clone https://gitee.com/arronzheng/pasm-agents && cd pasm-agents && pip install -e . ``` Line 219: ```markdown | `bionic` | Full PASM core and emotion module | `pip install pasm-agents[torch]` | ``` ### Technical Analysis The installation instructions do not pin package versions or verify package hashes. The source-installation alternative clones a mutable repository reference rather than a reviewed commit or signed release tag. Consequently, the code executed by these commands can change after this Skill has been reviewed. Python package installation may execute package-controlled build backend logic. Installing the cloned repository in editable mode also causes local execution and subsequent imports of code that is not present in the audited artifact. The audited project contains only `SKILL.md`; therefore, neither the packages' implementation nor their transitive dependencies could be inspected during this audit. This creates a supply-chain trust boundary in which compromise of a package-publishing account, package release, transitive dependency, source repository, or mutable branch could introduce arbitrary code. ### Attack Path 1. An attacker compromises the `pasm-agents` or `pasm-skills` publishing account, source repository, or one of their unpinned transitive dependencies. 2. The attacker publishes a malicious package release or modifies the repository's default branch. 3. A user follows one of the documented unpinn ...[truncated 883 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to an explicitly reviewed version rather than installing the latest available release. 2. Generate a fully resolved lock file that pins all transitive dependencies. 3. Require cryptographic hashes during installation, such as with a hash-locked requirements file and `pip install --require-hashes`. 4. Replace the mutable source clone with a verified commit: ```bash git clone https://gitee.com/arronzheng/pasm-agents cd pasm-agents git checkout --detach <reviewed-commit-hash> git verify-commit <reviewed-commit-hash> pip install . ``` 5. Prefer signed releases and verify package provenance or attestations before installation. 6. Build and inspect wheels in an isolated environment before deployment. Avoid directly installing editable source in production. 7. Include the implementation and dependency manifest in the Skill artifact so its behavior can be reviewed together with the documentation. 8. Run the application under a dedicated, least-privileged account with filesystem access limited to necessary state directories. 9. Protect locally stored health and emergency-contact data with restrictive permissions and, where appropriate, encryption at rest.