T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned External PyPI Package Is Installed and Executed## Vulnerability Details **File Location**: `SKILL.md:9-13` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: pip kind: pip package: vectorclaw-mcp label: "Install VectorClaw MCP (pip)" ``` The documentation repeats the unpinned installation procedure at `SKILL.md:40-41`: ```markdown 1. Install package: `pip install vectorclaw-mcp` 2. Configure SDK: `python3 -m anki_vector.configure` ``` ### Technical Analysis The Skill installs `vectorclaw-mcp` from PyPI without specifying an exact version or verifying an integrity hash. It then configures OpenClaw to execute the installed package using: ```yaml command: python3 args: - "-m" - "vectorclaw_mcp.server" ``` The audited project contains only `SKILL.md` and `README.md`; it does not contain the source code for `vectorclaw_mcp.server`. Consequently, the executable behavior cannot be reviewed from this artifact. Because package resolution is mutable, a compromised maintainer account, package repository, build pipeline, or later malicious release could cause users to install and execute code different from the code originally reviewed. This finding concerns supply-chain integrity. The audit found no direct evidence that the current external package is malicious. ### Attack Path 1. An attacker compromises the package publisher, distribution account, release pipeline, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the expected `vectorclaw-mcp` package name. 3. A user follows the Skill installation process, which requests the package without an exact version or hash. 4. The package installer resolves and installs the attacker-controlled release. 5. OpenClaw launches `python3 -m vectorclaw_mcp.server`. 6. The malicious package executes with the permissions of the OpenClaw user and receives the config ...[truncated 844 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, for example `vectorclaw-mcp==X.Y.Z`, rather than resolving the latest available release. 2. Verify package artifacts with approved cryptographic hashes, such as through a locked requirements file used with `pip --require-hashes`. 3. Include or link an immutable source revision corresponding exactly to the pinned package artifact. 4. Audit the complete `vectorclaw_mcp.server` implementation and all transitive dependencies before deployment. 5. Use signed releases and verify publisher identity, package provenance, and build attestations where supported. 6. Run the MCP server as a dedicated, unprivileged account with narrowly scoped filesystem and network access. 7. Restrict access to robot camera and motion controls to trusted workflows, and require confirmation for safety-sensitive physical actions where appropriate. 8. Add automated dependency monitoring while requiring explicit review before adopting updated versions.