T08 · Insecure Dependencies
Error
- Location
- SKILL.md:34
- Finding
- Unpinned Remote Repository Used as a Build Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-35` **Vulnerability Type**: Mutable remote dependency and unsafe source build **Risk Level**: High ### Vulnerable Code ```bash git clone https://gitee.com/random_player/cmic-skill-scanner.git cd cmic-skill-scanner && cargo build --release ``` ### Technical Analysis The build instructions clone the current default branch of a remote repository without pinning an audited commit or verifying a signed release tag or source checksum. Consequently, the code compiled by a user may differ from the code that was available when this skill package was reviewed. Building a Rust project can execute build scripts and procedural macros during compilation. Therefore, compromise of the repository, its dependencies, or the account controlling it could lead to code execution during the build itself, even if the resulting binary is never run. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, or a dependency resolved during the build. 2. The attacker adds malicious source code, a Cargo build script, or a malicious dependency to the mutable default branch. 3. A user follows the documented `git clone` command, which retrieves the attacker-controlled revision. 4. The user runs `cargo build --release`. 5. Malicious build-time code executes with the permissions and environment of the user running Cargo. 6. The resulting binary may also retain malicious behavior and execute later as the scanner. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user performing the build. Potential scope includes access to files readable by that user, modification of user-owned files, theft of environment variables or development credentials, network communication, and creation of a malicious scanner binary for subsequent execution. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Pin the repository to a specific, audited commit hash rather than cloning a mutable default branch. - Publish and require verification of a cryptographically signed release tag. - Provide a SHA-256 or stronger digest for the complete source archive. - Use a source repository controlled by a clearly identified, trusted organization. - Commit and audit `Cargo.lock`, and build with `cargo build --release --locked`. - Review build scripts, procedural macros, and transitive dependencies before compilation. - Prefer reproducible builds and publish provenance or attestation linking the source revision to the distributed binary. ]]>