T08 · Insecure Dependencies
Error
- Location
clawhub.json:8- Finding
Unpinned Third-Party SDK Executes in a Credentialed Trading Process
- Content
View full analysis
SDK tab") sys.exit(1) venue = os.environ.get("TRADING_VENUE", "kalshi") _client = SimmerClient(api_key=api_key, venue=venue, live=live) return _client ``` ### Technical Analysis The project declares `simmer-sdk` without a version constraint or integrity hash. Consequently, installation can resolve to a package release that was not part of this audit. The dependency is imported into the same Python process that has access to a high-value trading API key and, according to the package metadata, a Solana private key. Python package code can execute immediately during import. A compromised or unexpectedly modified SDK release could therefore inspect process environment variables, redirect network requests, alter order parameters, or initiate unauthorized activity. The audited project does not contain the SDK source, so its network destinations and credential-handling implementation could not be independently verified. The use of an external SDK is consistent with the declared trading functionality. The security issue is the absence of a reproducible, integrity-veri ...[truncated 1430 chars]- Remediation
View remediation