T08 · Insecure Dependencies
Error
- Location
- SKILL.md:31
- Finding
- Unpinned Third-Party Repository Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 31–36 **Vulnerability Type**: Unpinned and mutable remote dependency **Risk Level**: High **Complete Code Snippet**: ```bash # From the repo root pip install -e . # Or via pipx for isolated install pipx install git+https://github.com/Catafal/lead-gen-factory.git ``` ### Technical Analysis The Skill instructs users to install software directly from the default branch of a third-party Git repository. The dependency is not pinned to a release version, immutable commit hash, or verified artifact checksum. Consequently, the code installed by this command can change after the Skill has been reviewed. Python installation can invoke package-controlled build backends or installation hooks. The installed `lgf` executable subsequently runs with the invoking user's permissions. Because the executable source and package metadata are absent from the audited artifact, its installation behavior, network activity, filesystem access, and handling of `TAVILY_API_KEY` and `OPENROUTER_API_KEY` cannot be independently verified. The local `pip install -e .` alternative is also not usable from the supplied artifact because the project contains only `SKILL.md` and no Python package or build metadata. ### Attack Path 1. An attacker compromises the referenced repository, obtains maintainer access, or causes malicious changes to be merged into its default branch. 2. The attacker adds malicious installation behavior, build hooks, or runtime logic to the package. 3. A user follows the Skill instructions and runs: ```bash pipx install git+https://github.com/Catafal/lead-gen-factory.git ``` 4. `pipx` retrieves the current repository contents rather than a previously audited immutable revision. 5. Package-controlled code may execute during installation or when the user subsequently invokes `lgf`. 6. The malicious code runs with the user's privileges and may access reso ...[truncated 997 chars]
- Remediation
- ## Remediation Suggestions 1. Publish the reviewed implementation as a versioned package from a controlled package registry. 2. Pin installation to an immutable release version or full Git commit hash rather than the repository's default branch. 3. Distribute and verify cryptographic hashes or signed release artifacts before installation. 4. Include lockfiles and hashes for transitive dependencies to reduce supply-chain variability. 5. Prefer isolated installation and execution with only the filesystem and network permissions required for lead research. 6. Include the reviewed executable source and package metadata in the Skill artifact so installation hooks and runtime behavior can be audited. 7. Document the exact repository revision reviewed and establish a process for re-auditing dependency updates. 8. Restrict the permissions and quotas of the Tavily and OpenRouter API keys, store the credential file with user-only permissions, and avoid exposing secrets through command-line arguments or logs.