T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Third-Party Installation Sources## Vulnerability Details **File Location**: `SKILL.md`, lines 12–25 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Evidence ```yaml "install": [ { "id": "brew", "kind": "brew", "formula": "steipete/tap/gifgrep", "bins": ["gifgrep"], "label": "Install gifgrep (brew)", }, { "id": "go", "kind": "go", "module": "github.com/steipete/gifgrep/cmd/gifgrep@latest", "bins": ["gifgrep"], "label": "Install gifgrep (go)", }, ``` ### Technical Analysis The Go installation source uses the mutable `@latest` version selector rather than an immutable, reviewed release. Consequently, the code installed in the future may differ from the code that existed when this Skill was audited. The alternative installation method relies on the third-party Homebrew tap `steipete/tap` without an explicit version or integrity constraint, creating another external supply-chain trust boundary. These instructions do not establish that either upstream source is currently malicious. The security issue is that installation can retrieve and execute externally maintained code whose effective contents may change after review, without a version pin, commit pin, checksum, or signature verification requirement. ### Attack Path 1. An attacker compromises the upstream repository, package publication process, release artifact, custom Homebrew tap, or a maintainer account. 2. The attacker publishes a modified package as the latest Go version or changes the formula or artifact supplied through the custom Homebrew tap. 3. A user or agent follows the Skill installation metadata and installs `gifgrep`. 4. The package manager retrieves the altered dependency because no immutable version or verified artifact is required. 5. The al ...[truncated 726 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a specific, reviewed Go module version, such as an explicitly selected semantic version. 2. Where feasible, pin installation artifacts to immutable commit identifiers and verify cryptographic checksums or signatures. 3. Pin the Homebrew formula to a reviewed release and document the expected artifact digest or signature. 4. Prefer trusted, reproducible distribution channels with provenance attestations over mutable custom sources. 5. Establish a dependency update process that reviews source changes and release provenance before advancing pinned versions. 6. Run installation and the resulting tool with least privilege; do not install as an administrator unless technically necessary.