T08 · Insecure Dependencies
Error
- Location
scripts/_stack_tools.py:19- Finding
Unpinned Dependencies and Unverified Dynamic Execution of Stack Tools
- Content
View full analysis
Vulnerability Details
File Location:
scripts/_stack_tools.py:19-31,scripts/_stack_paths.py:73-76,scripts/self_check.py:15-16, andSKILL.md:39-45
Vulnerability Type: T08: Insecure Dependencies
Risk Level: HighVulnerable Code
SKILL.md:39-45:bash npx clawhub@latest install deepseekoracle/lygo-protocol-stack-operator npx clawhub@latest install deepseekoracle/lygo-network-builder npx clawhub@latest install deepseekoracle/lygo-sovereign-super-skill npx clawhub@latest install deepseekoracle/lygo-haven-star-chart npx clawhub@latest install deepseekoracle/lygo-lattice-birth export LYGO_STACK_ROOT=/absolute/path/to/lygo-protocol-stackscripts/_stack_paths.py:73-76:python def _assert_stack(p: Path) -> None: missing = [rel for rel in _REQUIRED_FILES if not (p / rel).is_file()] if missing: raise SystemExit(f"Invalid stack root {p}; missing: {missing}")scripts/_stack_tools.py:19-31:python def load_tool(stack_root: Path, basename: str) -> ModuleType: if basename not in ALLOWED_TOOLS: raise ValueError(f"Tool not allowlisted: {basename}") path = (stack_root / "tools" / basename).resolve() expected = (stack_root / "tools" / basename).resolve() if path != expected or not path.is_file(): raise FileNotFoundError(f"Missing stack tool: {basename}") spec = importlib.util.spec_from_file_location(f"lygo_birth_{basename[:-3]}", path) if spec is None or spec.loader is None: raise ImportError(f"Cannot load {basename}") mod = importlib.util.module_from_spec(spec) sys.modules[spec.name] = mod spec.loader.exec_module(mod) return modscripts/self_check.py:15-16:python for name in sorted(ALLOWED_TOOLS): mod = load_tool(stack, name)Technical Analysis
The installation instructions use the mutable
latestversion of the package installer and d ...[truncated 2115 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
clawhuband every installed skill to an immutable, reviewed version rather than usinglatest. - Maintain a lock manifest containing cryptographic hashes for every dynamically loaded stack tool.
- Verify tool hashes or trusted publisher signatures immediately before every import.
- Authenticate
LYGO_STACK_ROOTas a specific trusted repository revision rather than validating it solely by file presence. - Fail closed if the stack revision or any allowlisted tool differs from the approved manifest.
- Treat basename allowlisting as input validation, not as a security sandbox.
- If stack tools are outside the same trusted release boundary, execute them in a restricted subprocess or container with a minimal environment, read-only filesystem access, disabled network access, and explicit resource limits.
- Avoid importing external modules merely for a self-check because imports execute module initialization code. Static hash and signature checks should occur before any module is loaded.
- Pin