T08 · Insecure Dependencies
Warning
- Location
SKILL.md:270- Finding
Unpinned Third-Party Dependencies and Mutable Installation Sources
- Content
View full analysis
- Remediation
View remediation
``` 2. Use hash verification for Python packages, preferably through a locked requirements file: ```text cellcog== \ --hash=sha256: ``` Install it with hash enforcement: ```text pip install --require-hashes -r requirements.txt ``` 3. Pin npm, OpenClaw, repository, and Skill installations to exact versions or immutable commit hashes. Avoid relying on mutable branches, tags, or implicitly resolved latest releases. 4. Publish and maintain lockfiles that capture direct and transitive dependency versions. 5. Verify package signatures, provenance attestations, and checksums where supported. Document the authoritative registry and publisher identity. 6. Remove `-U` from routine installation instructions unless an update has been reviewed and intentionally approved. 7. Review dependency updates before changing pinned versions. Include source review, malware scanning, provenance validation, and testing in a restricted environment. 8. Run package installation and CellCog execution with least privilege. Restrict filesystem access, network access, subprocess execution, and available environment variables. 9. Keep `CELLCOG_API_KEY` scoped to the minimum required permissions and avoid exposing unrelated secrets to the process environment. 10. Document the trusted source, reviewed version, expected package hashes, and a controlled update procedure directly in the Skill. ]]>