T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party CLI Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 14-18 **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ```bash ## Installation ```bash go install github.com/BRO3886/ical/cmd/ical@latest ``` ``` ### Technical Analysis The installation command uses the mutable Go module selector `@latest`. Consequently, the source code downloaded, compiled, and installed at execution time may differ from the version that was reviewed during this audit. The project does not specify an immutable version or commit, verify a checksum or signature, or require inspection of the resolved dependency before execution. Although no malicious behavior was identified in the audited documentation itself, this installation approach creates a supply-chain trust boundary. A compromise of the upstream repository, its release process, the maintainer account, or the dependency-resolution path could cause users to compile and install attacker-controlled code. ### Attack Path 1. An attacker compromises the upstream repository, release workflow, maintainer credentials, or another relevant supply-chain component. 2. The attacker publishes a malicious version that Go resolves through the `@latest` selector. 3. A user or AI agent follows the documented installation command. 4. Go retrieves and compiles the mutable upstream source. 5. The resulting binary is installed and later executed with the invoking user's permissions. 6. The malicious binary can abuse those permissions and any Calendar access granted to the application. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the invoking user's account. The malicious binary could access or modify files available to that user, manipulate Calendar data after receiving the required macOS permissions, or perform other actions within the user's privilege boundary. The documentation does not request elevated administrative privileges, so pr ...[truncated 170 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a reviewed, immutable semantic version: ```bash go install github.com/BRO3886/ical/cmd/ical@vX.Y.Z ``` 2. For stronger reproducibility, document the exact audited commit and provide a controlled source-build procedure. 3. Publish expected source or release-artifact checksums and require integrity verification before installation. 4. Document how maintainers authenticate releases, preferably using signed tags or signed release artifacts. 5. Review the selected release and its transitive dependencies before updating the pinned version. 6. Replace the placeholder clone URL in the source-build instructions with the exact repository URL and require checkout of a pinned tag or commit before building.