T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:185
- Finding
- Execution of an Unpinned Remote Container Image## Vulnerability Details **File Location**: `SKILL.md`, lines 185-189 **Vulnerability Type**: Unpinned third-party container dependency **Risk Level**: Medium **Vulnerable Code**: ```powershell ### Q: 如何在 Docker 中使用？ **A**: 使用官方 Docker 镜像： ```powershell docker run ghcr.io/alexsjones/llmfit --version ``` ``` ### Technical Analysis The documented `docker run` command references `ghcr.io/alexsjones/llmfit` without an immutable digest or an explicit version tag. Docker consequently resolves the reference to the registry's default tag, normally `latest`. The content associated with that mutable tag may change after the skill has been audited. This creates a supply-chain risk because following the documentation can download and execute container code that was not part of the reviewed project. A registry-account compromise, unauthorized image replacement, or unreviewed upstream release could alter the effective payload. ### Attack Path 1. An attacker compromises the upstream registry account, publishing process, or mutable default image tag. 2. The attacker replaces or updates the referenced image with a malicious image. 3. A user follows the skill documentation and runs `docker run ghcr.io/alexsjones/llmfit --version`. 4. Docker retrieves the altered image and starts its configured entry point locally. 5. The malicious process executes with the permissions and resources granted to the container. ### Impact Assessment The altered image could execute arbitrary code within the container, consume host CPU, memory, storage, and network resources, or access any capabilities and resources exposed by the local Docker configuration. The shown command does not explicitly mount host directories, expose credentials, request privileged mode, or mount the Docker socket, which limits the direct host-access scope. Impact would increase if the environment applies permissive defaults, supplies credentials, or contains a vulnerable co ...[truncated 16 chars]
- Remediation
- ## Remediation Suggestions - Pin the container to a reviewed release and immutable digest, for example: ```powershell docker run --rm ghcr.io/alexsjones/llmfit:0.9.8@sha256:<verified-digest> --version ``` - Obtain the digest from a trusted release channel and verify it independently before documenting it. - Enable signature or provenance verification with an appropriate container verification tool. - Use `--rm` to remove the stopped container after execution. - Apply least-privilege container controls, such as a non-root user, dropped Linux capabilities, a read-only filesystem, and restricted networking where compatible. - Establish a controlled process for reviewing and updating the pinned version and digest.