T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Executable dependency installed from a mutable Git reference without integrity verification## Vulnerability Details **File Location**: `SKILL.md:15` and `SKILL.md:137` **Vulnerability Type**: Unverified third-party VCS dependency **Risk Level**: Medium ### Vulnerable Code Installation metadata at `SKILL.md:15`: ```json "package": "amplifier-app-openclaw @ git+https://github.com/microsoft/amplifier-app-openclaw@v1.0.5", ``` Manual installation command at `SKILL.md:137`: ```bash uv tool install "amplifier-app-openclaw @ git+https://github.com/microsoft/amplifier-app-openclaw@v1.0.5" ``` ### Technical Analysis The Skill directs `uv` to fetch and install executable Python package code directly from a remote Git repository. The dependency is pinned to the tag `v1.0.5`, but a Git tag is not necessarily immutable and can potentially be deleted or retargeted. The installation process does not verify an immutable commit SHA, artifact hash, or cryptographic signature. The package's source code, build configuration, and transitive dependencies are not included in the audited project. Package installation may execute build-system code, and the installed command will subsequently execute the downloaded application code. Consequently, the effective code executed by users can differ from the code that was originally reviewed. No evidence establishes that the referenced package is currently malicious. The vulnerability is the absence of controls ensuring that future installations retrieve the same audited content. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, release credentials, or another relevant dependency source. 2. The attacker replaces or retargets the `v1.0.5` tag, or compromises a transitive dependency resolved during installation. 3. A user installs the Skill dependency through its declared installation metadata or the documented `uv tool install` command. 4. `uv` downloads the attacker-controlled source or dependency content. 5. Malicious code executes during package building, installation, or later ...[truncated 919 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable tag with a reviewed, immutable full commit SHA. 2. Prefer a trusted release artifact with published cryptographic hashes or signatures, and verify those values before installation. 3. Lock all transitive dependencies to reviewed versions and enforce hash verification where supported. 4. Record the expected upstream repository identity and reviewed commit in the Skill documentation. 5. Perform installation only after explicit user approval, clearly disclosing that remote executable code and transitive dependencies will be downloaded. 6. Run installation and delegated workloads in a sandbox or least-privileged environment without unnecessary credentials or sensitive filesystem access. 7. Periodically audit the pinned source and dependency lock before updating either. 8. Consider distributing a reproducibly built, signed package through a trusted package registry rather than installing directly from a VCS URL.