T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:37
- Finding
- Unpinned Third-Party Package and Unverified Model Artifact Downloads## Vulnerability Details **File Location**: `SKILL.md`, lines 37-45 **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and unverified external artifacts **Risk Level**: Medium ### Vulnerable Code ```bash uv tool install kokoro-tts ``` ```bash wget https://github.com/nazdridoy/kokoro-tts/releases/download/v1.0.0/kokoro-v1.0.onnx wget https://github.com/nazdridoy/kokoro-tts/releases/download/v1.0.0/voices-v1.0.bin ``` ### Technical Analysis The installation command retrieves `kokoro-tts` and its transitive dependencies without pinning an exact version or using a reviewed dependency lock. Consequently, the installed code may differ between installations and can change after this Skill has been audited. The ONNX model and voice-data file are downloaded from a personal GitHub repository without cryptographic checksum or signature verification. Although `voices-v1.0.bin` is presented as voice data rather than directly executed code, both downloaded files are subsequently consumed by local software and therefore remain within the attack surface of the relevant file parsers and model runtime. Installing a TTS runtime and obtaining its model files are necessary for the declared local text-to-speech functionality. However, relying on mutable package resolution and accepting downloaded artifacts without integrity verification are not necessary privileges or risks. The Skill does not itself establish that the referenced artifacts are malicious, and it does not pipe the downloads directly into a shell; the issue is the absence of controls against future package, account, release, or distribution-channel compromise. ### Attack Path 1. An attacker compromises the package registry account, source repository, GitHub release, or a transitive dependency used by `kokoro-tts`. 2. The attacker publishes malicious package code or replaces a referenced model or voice artifact. 3. A user follows the Skill instructio ...[truncated 1364 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `kokoro-tts` to a specific reviewed version rather than resolving the latest available release: ```bash uv tool install 'kokoro-tts==<reviewed-version>' ``` 2. Lock and review transitive dependencies, and retain hashes for all resolved package artifacts where the package tooling supports hash verification. 3. Publish trusted SHA-256 digests for both downloaded files and verify them before use: ```bash wget --https-only https://github.com/nazdridoy/kokoro-tts/releases/download/v1.0.0/kokoro-v1.0.onnx wget --https-only https://github.com/nazdridoy/kokoro-tts/releases/download/v1.0.0/voices-v1.0.bin sha256sum --check kokoro-assets.sha256 ``` 4. Prefer signed release artifacts and verify signatures against a documented, organization-controlled public key. 5. Mirror reviewed artifacts in an organization-controlled, immutable repository if the original personal repository does not provide an adequate trust model. 6. Perform installation and model processing as an unprivileged user in an isolated environment with only the input and output paths required for text-to-speech conversion. 7. Document the expected publisher, package version, artifact sizes, hashes, and update-review procedure so changes cannot silently enter the installation path.