T08 · Insecure Dependencies
Error
- Location
- references/deployment.md:13
- Finding
- Unpinned Third-Party Repository Is Downloaded and Executed Locally<![CDATA[ ## Vulnerability Details **File Location**: `references/deployment.md:13-27`; related automatic startup instruction at `SKILL.md:108-109` **Vulnerability Type**: Untrusted and unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash ### 1. Clone the fork git clone https://github.com/AxelHu/wewe-rss.git cd wewe-rss ### 2. Start the wewe-rss container docker compose up -d ### 3. Start the REST API # Requires Python 3.8+ python3 api_server.py ``` The Skill also instructs the agent to start the deployment automatically if the service is unavailable: ```text - If the container is not running: run `docker compose up -d` in the `~/.openclaw/workspace/wewe-rss/` directory. ``` ### Technical Analysis The deployment procedure clones the current default branch of a personal GitHub fork and immediately executes both its Docker Compose configuration and its Python API server. No immutable commit, release tag, container image digest, checksum, or cryptographic signature is specified. The executable repository content is not included in the audited Skill package. Consequently, the effective code cannot be reviewed as part of this audit and can change after the Skill is published. Running Docker Compose is particularly sensitive because the remote configuration can define container images, host bind mounts, environment variables, networking behavior, privileged mode, and other host-facing capabilities. The automatic recovery instruction increases exposure by encouraging execution of the downloaded Compose configuration whenever the local service is unavailable. ### Attack Path 1. An attacker compromises the upstream GitHub account, repository, dependency pipeline, or a referenced mutable container image. 2. The attacker modifies `docker-compose.yml`, `api_server.py`, or another startup component on the default branch. 3. A user follows the documented deployment procedure and clones the latest repository content without i ...[truncated 981 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the repository to a reviewed immutable commit hash rather than cloning the current default branch. 2. Pin every container image by cryptographic digest, not by a mutable tag. 3. Vendor the reviewed Compose file and API server into the Skill package when licensing permits, so their behavior is included in the audit. 4. Publish and verify checksums or signed release artifacts before execution. 5. Review Compose settings and prohibit unnecessary privileged mode, Docker socket mounts, host networking, host filesystem mounts, and excessive Linux capabilities. 6. Run the API and containers as non-root users with read-only filesystems and narrowly scoped volumes. 7. Replace automatic startup of potentially changed files with an explicit user confirmation and integrity-verification step. 8. Document the exact reviewed upstream commit and establish a controlled update process requiring a new security review. ]]>