T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party Packages and Mutable Source Repositories Are Executed Locally## Vulnerability Details **File Location**: `SKILL.md`, lines 47-58 and 115-119 **Vulnerability Type**: Unpinned executable third-party dependencies **Risk Level**: Medium The documented setup retrieves external Python packages or mutable Git repository branches and subsequently executes their code. The reviewed project contains only `SKILL.md`; therefore, the implementation supplied by these external sources could not be audited. ```bash pip install --upgrade pasm-agents python -m pasm_skills list python -m pasm_skills run --all ``` The alternative source installation is also unpinned: ```bash git clone https://github.com/arronJack/pasm-skills.git git clone https://github.com/arronJack/pasm-agents.git export PYTHONPATH="$PWD/pasm-skills:$PWD/pasm-agents" export PASM_SKILLS_AGENT_MODULES=pasm_agents.verifiers python -m pasm_skills list ``` The quick-start path similarly installs and executes the package without a fixed version or integrity verification: ```bash pip install pasm-agents python -m pasm_skills list python -m pasm_skills agents python -m pasm_skills run core-verifier ``` ### Technical Analysis Neither installation method pins an exact package version, dependency set, Git tag, commit SHA, or cryptographic hash. The PyPI command resolves the latest package and transitive dependencies available at installation time, while the Git commands clone the repositories' mutable default branches. The later `python -m pasm_skills` commands import and execute the downloaded implementation with the invoking user's permissions. Consequently, the effective executable payload can change after this skill document has been reviewed. A compromised maintainer account, malicious package release, compromised transitive dependency, or altered default branch could introduce attacker-controlled Python code. No evidence establishes that the currently referenced upstream packages are malicious. The confirmed issu ...[truncated 1720 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `pasm-agents`, `pasm-skills`, and every transitive dependency to reviewed versions in a lockfile. 2. Require package hashes using a hash-locked requirements file, such as `pip install --require-hashes -r requirements.txt`. 3. Replace mutable Git clones with checkout instructions referencing reviewed commit SHAs. Verify signed commits or release tags where available. 4. Publish expected artifact checksums and verify them before installation or execution. 5. Include or vendor the executable implementation in the reviewed artifact when feasible, allowing the behavior invoked by the skill to be audited together with its documentation. 6. Disable dependency resolution from untrusted or supplemental package indexes and use an approved internal package mirror in CI. 7. Execute verification agents in an isolated, non-privileged environment with read-only access to repositories where possible, a minimal environment, no unnecessary credentials, and restricted network access. 8. Document the exact reviewed package versions and commit identifiers directly in `SKILL.md`, including a controlled update and re-audit process.