T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Mandatory Installation of Unpinned Third-Party Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40-49` **Vulnerability Type**: Unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown **HARD GATE — If `lobster` is not installed, STOP. Install it NOW before doing anything else:** ```bash uv venv --python 3.12 .venv && source .venv/bin/activate uv pip install 'lobster-ai[anthropic]' # or [openai], [google], depending on provider lobster --version # Must succeed before you proceed ``` Do NOT skip this. Do NOT "come back to it later". Do NOT manually create package directories. `lobster scaffold agent` is the ONLY way to create new agent packages — it generates correct PEP 420 structure, entry points, AQUADIF metadata, and contract tests that you WILL get wrong by hand. ``` ### Technical Analysis The Skill directs the agent to install `lobster-ai` and its provider-specific transitive dependencies from the default Python package index without: - Pinning a reviewed package version. - Using a lockfile. - Requiring package hashes. - Verifying the publisher or artifact provenance. - Requesting explicit user authorization before modifying the environment. Because the requirement is expressed as a mandatory hard gate, an agent following the Skill may install packages even when the user's request only requires source inspection or planning. Python package installation can place executable modules, command-line entry points, and other package-controlled files into the virtual environment. The effective code installed can change after the Skill itself has been reviewed because the dependency version is resolved at execution time. The command creates a project-local virtual environment, so it does not inherently obtain root privileges. Nevertheless, package code subsequently imported or invoked operates with the permissions of the user running the agent. ### Attack Path 1. An attacker compromises `lobster-ai`, one of its transitive dependencies, or th ...[truncated 1346 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user approval before creating a virtual environment or installing any package. 2. Pin `lobster-ai` and provider extras to reviewed versions, for example through a checked-in lockfile. 3. Require cryptographic hashes for downloaded distributions where supported. 4. Prefer a private or explicitly configured trusted package index for controlled environments. 5. Document the expected package publisher, repository, and version so users can verify provenance. 6. Separate read-only planning and source-analysis workflows from workflows that require installation. 7. Replace the unconditional hard gate with a safe prompt such as: - Report that Lobster is missing. - Explain why installation may be needed. - Show the exact proposed command and dependency source. - Wait for user approval before executing it. 8. Run installation and validation in an isolated, minimally privileged environment without unrelated credentials. ]]>