T08 · Insecure Dependencies
Error
- Location
- clawhub.json:3
- Finding
- Unpinned Third-Party Trading SDK Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `clawhub.json:3`; `SKILL.md:144` **Vulnerability Type**: Unpinned executable dependency **Risk Level**: High ### Complete Code Snippet From `clawhub.json:3`: ```json "requires": {"env": ["SIMMER_API_KEY"], "pip": ["simmer-sdk"]}, ``` From `SKILL.md:144`: ```markdown Requires `simmer-sdk` (pip install simmer-sdk) and a valid `SIMMER_API_KEY`. ``` ### Technical Analysis The project installs `simmer-sdk` without an exact version, package hash, or lock file. Consequently, installation can resolve to a package version that was not part of this audit. This dependency is security-sensitive because `trader.py` imports `SimmerClient` from it and provides the `SIMMER_API_KEY` directly to the client. The SDK also mediates position retrieval, market discovery, and trade submission. A compromised or unexpectedly modified package version would therefore execute within the Skill process and could access its environment and trading operations. The reviewed project does not demonstrate dependency confusion or prove that the current package is malicious. The vulnerability is the absence of controls ensuring that future installations obtain the specific audited artifact. ### Attack Path 1. An attacker compromises the package registry account, publication process, or upstream source for `simmer-sdk`. 2. The attacker publishes a malicious release under the expected package name. 3. A new Skill installation executes `pip install simmer-sdk` without a version constraint or integrity hash. 4. The package installer selects and installs the attacker-controlled release. 5. Import-time code or malicious `SimmerClient` methods execute with the privileges of the Skill process. 6. When the Skill constructs the client, the malicious package receives `SIMMER_API_KEY`. 7. The package can exfiltrate the credential, alter authenticated requests, submit unauthorized trades, or access other data available to the process. ### Impact As ...[truncated 479 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `simmer-sdk` to a specific audited version, such as an exact `==` constraint. 2. Maintain a lock file containing all transitive dependency versions. 3. Require cryptographic package hashes during installation, for example with pip's `--require-hashes`. 4. Verify that the package originates from the expected publisher and documented source repository. 5. Review each dependency update before changing the pinned version. 6. Run the Skill in an isolated environment with minimal filesystem and network permissions. 7. Scope `SIMMER_API_KEY` to only the operations and account limits required by this Skill. 8. Prefer short-lived or readily revocable credentials where supported. ]]>