T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:243
- Finding
- Unpinned Third-Party Dependencies and Delegated Skill Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 243–246; related delegated instruction at line 26 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Complete Code Snippet ```markdown For your first CellCog task in a session, read the **cellcog** skill for the full SDK reference — file handling, chat modes, timeouts, and more. ``` ```markdown ## If CellCog is not installed **Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog` **OpenClaw:** `openclaw skills install @cellcog/cellcog` **CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool) **Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference. ``` ### Technical Analysis The documented installation methods retrieve mutable third-party packages or skill content without specifying an exact version, immutable commit, checksum, or package-integrity value. In particular, `pip install -U cellcog` explicitly selects an available newer release, while the `npx` and OpenClaw installation commands similarly contain no reviewed version constraint. The skill also delegates operational guidance to a separately installed `cellcog` skill. That delegated skill is not part of the audited project, so its instructions and future changes cannot be validated from this artifact. This creates a supply-chain trust boundary: the behavior users eventually execute can differ from the content reviewed in `SKILL.md`. This finding does not establish that the current CellCog packages are malicious. The vulnerability is the unsafe, mutable dependency acquisition process and the absence of integrity controls. ### Attack Path 1. An attacker compromises an upstream publisher account, package registry entry, repository, distribution process, or another dependency used by the named package. 2. The attacker publishes a malicious or altered re ...[truncated 1264 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency and skill to an exact, reviewed version or immutable source commit. 2. Require cryptographic integrity verification, such as package hashes, signed releases, or an equivalent trusted registry mechanism. 3. Replace `pip install -U cellcog` with a version-pinned and hash-verified installation procedure. 4. Avoid running an unpinned package runner through `npx`; pin both the runner and the installed skill source. 5. Pin the OpenClaw skill installation to a reviewed release if the platform supports version constraints. 6. Maintain a lockfile or approved dependency manifest and validate it in CI. 7. Include the referenced `cellcog` skill in the audit scope, or vendor a reviewed copy rather than delegating to mutable external instructions. 8. Run the SDK with least privilege in a sandbox that restricts filesystem, credential, and network access. 9. Store `CELLCOG_API_KEY` in an appropriate secret manager and ensure it is exposed only to the process that requires it. 10. Document that prompts and supplied files may be transmitted to an external service so users can avoid submitting confidential material without authorization.