T08 · Insecure Dependencies
Warning
- Location
- scripts/opencli.sh:4
- Finding
- Execution of Unverified External and PATH-Resolved OpenCLI Programs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/opencli.sh:4-13` **Vulnerability Type**: Unverified external executable delegation and unsafe executable resolution **Risk Level**: Medium ### Vulnerable Code ```bash PROJECT_DIR="/Users/ShiXin/Documents/Workspace/github-project/opencli" SOURCE_ENTRY="$PROJECT_DIR/dist/main.js" if [[ -f "$SOURCE_ENTRY" ]]; then cd "$PROJECT_DIR" exec node "$SOURCE_ENTRY" "$@" fi if command -v opencli >/dev/null 2>&1; then exec "$(command -v opencli)" "$@" fi ``` The associated documentation in `SKILL.md:35-37` states that the external source repository is automatically synchronized with `origin/main`: ```markdown **自动同步：** 本地 source repo 由 cron job `每周二技能升级检查`（每周二 09:00）自动同步 origin/main。无需手动更新。 ``` ### Technical Analysis The wrapper delegates execution to code that is not included in the audited skill package. The preferred entrypoint, `/Users/ShiXin/Documents/Workspace/github-project/opencli/dist/main.js`, is validated only with a file-existence check. Its integrity, ownership, permissions, version, and cryptographic digest are not verified before it is executed by Node.js. The documentation further indicates that the external repository is automatically synchronized from the mutable `origin/main` branch. Consequently, the executable behavior can change after the skill has been reviewed. A compromised upstream repository, source-control account, synchronization process, or local checkout could introduce arbitrary JavaScript that the wrapper would subsequently execute. If the source entrypoint is unavailable, the wrapper executes the first `opencli` program resolved through the invoking process's `PATH`. It does not verify that this executable comes from an approved location or trusted owner. An attacker who can influence `PATH` or place an executable in an earlier searched directory could therefore substitute a malicious program. Arguments are forwarded safely as `"$@"`; the issue is not shell com ...[truncated 1963 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Package the reviewed OpenCLI implementation with the skill, or depend on a pinned, immutable release rather than a mutable external checkout. 2. Verify the executable artifact against an approved cryptographic digest or trusted digital signature before every execution. 3. Pin automatic updates to reviewed release tags or immutable commit hashes. Do not automatically place changes from `origin/main` into the trusted execution path. 4. Perform updates in a staging location, verify signatures and hashes, run security checks, and promote the artifact only after approval. 5. Remove the generic `PATH` fallback where possible. Configure an explicit absolute path to an approved OpenCLI executable. 6. If fallback behavior is required, maintain an allowlist of trusted executable paths and validate the selected file's canonical path, owner, permissions, and integrity before execution. 7. Fail closed when integrity or provenance checks cannot be completed instead of silently executing another available binary. 8. Run OpenCLI with the minimum required permissions and a sanitized environment. Limit exposure to unnecessary credentials, browser sessions, Docker sockets, and external CLI authentication material. ]]>