T08 · Insecure Dependencies
Warning
- Location
- references/requirements.txt:1
- Finding
- Unpinned Executable Dependencies Allow Supply-Chain Drift<![CDATA[ ## Vulnerability Details **File Location**: `references/requirements.txt:1-3`; dependency installation occurs at `scripts/setup.sh:101-108` **Vulnerability Type**: Unpinned third-party dependencies without integrity verification **Risk Level**: Medium ### Vulnerable Code `references/requirements.txt:1-3`: ```text mcp[cli]>=1.0.0 akshare>=1.14.0 yfinance>=0.2.40 ``` `scripts/setup.sh:101-108`: ```bash info "安装 Python 依赖..." if command -v uv &>/dev/null; then uv pip install --python "$VENV_PYTHON" -r "$REQUIREMENTS" else "$VENV_PYTHON" -m pip install --upgrade pip -q "$VENV_PYTHON" -m pip install -r "$REQUIREMENTS" -q fi ``` ### Technical Analysis All three dependencies use minimum-version constraints rather than exact, reviewed versions. Consequently, each installation can resolve a different dependency graph, including future releases that were not part of this audit. The installation process also lacks package hashes or another integrity-verification mechanism. Python packages and their transitive dependencies may execute build-backend or installation-related code during resolution and installation. They are subsequently imported by the MCP server, allowing malicious runtime initialization code to execute as well. This creates a supply-chain exposure if an allowed upstream release or transitive dependency is compromised. The README additionally recommends `npx clawhub@latest`, which similarly resolves a mutable package version, although the confirmed Python dependency issue is directly represented by the requirements file and setup script. ### Attack Path 1. An attacker compromises one of the permitted Python packages, its distribution account, or a transitive dependency. 2. A malicious version is published with a version satisfying the broad `>=` constraint. 3. A user runs `scripts/setup.sh`. 4. `pip` or `uv` resolves and downloads the malicious version because no exact lock or hash restricts it. 5. Malicious code executes du ...[truncated 930 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace minimum-version constraints with exact, reviewed versions, including relevant transitive dependencies. 2. Generate and commit a reproducible lock file using a tool such as `pip-compile`, Poetry, or `uv lock`. 3. Require cryptographic hashes for downloaded artifacts, such as through `pip install --require-hashes`. 4. Pin the package installer and build tooling used by the installation process. 5. Replace documentation references to mutable `@latest` releases with a reviewed version. 6. Establish a controlled dependency-update process that includes vulnerability scanning, changelog review, and testing before lock-file updates. 7. Prefer binary wheels from trusted registries where appropriate, and explicitly configure the accepted package index to reduce dependency-confusion exposure. ]]>