T08 · Insecure Dependencies
Warning
- Location
- calibration_report.py:27
- Finding
- Unpinned Third-Party Dependency Executes in a Runtime Containing a Trading API Key<![CDATA[ ## Vulnerability Details **File Location**: `calibration_report.py:27-38` **Additional Locations**: `clawhub.json:3-6`, `SKILL.md:18-26`, `README.md:41-45` **Vulnerability Type**: Unpinned third-party dependency and unnecessary credential exposure **Risk Level**: Medium ### Vulnerable Code `calibration_report.py:27-38`: ```python from simmer_sdk.skill import load_config, update_config, get_config_path SKILL_SLUG = "simmer-calibration-report" TRADE_SOURCE = "sdk:calibration-report" CONFIG_SCHEMA = { "journal_path": {"env": "CALIB_JOURNAL_PATH", "default": "", "type": str}, "min_trades": {"env": "CALIB_MIN_TRADES", "default": 10, "type": int}, "lookback_days": {"env": "CALIB_LOOKBACK_DAYS", "default": 30, "type": int}, "include_unresolved": {"env": "CALIB_INCLUDE_UNRESOLVED", "default": "false", "type": str}, } _config = load_config(CONFIG_SCHEMA, __file__, slug=SKILL_SLUG) ``` `clawhub.json:3-6`: ```json "requires": { "env": ["SIMMER_API_KEY"], "pip": ["simmer-sdk"] }, ``` `SKILL.md:18-26`: ```markdown 1. Install dependencies: ```bash pip install simmer-sdk ``` 2. Set your API key: ```bash export SIMMER_API_KEY=your_key_here ``` ``` `README.md:41-45`: ```markdown ## Quick Start 1. **Install:** `pip install simmer-sdk` 2. **Set key:** `export SIMMER_API_KEY=your_key_here` 3. **Run:** `python calibration_report.py --live` ``` ### Technical Analysis The project installs `simmer-sdk` without an exact version constraint, lock file, or integrity hash. The package is then imported at module scope, and its `load_config` function is executed immediately when `calibration_report.py` is loaded. Python dependencies can execute arbitrary code during module import. Therefore, any compromised, replaced, or unexpectedly modified version selected by `pip install simmer-sdk` runs with the permissions and environment of the report process. The runtime manifest and documentation also require users to place `SIMMER_A ...[truncated 2364 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin an audited dependency version** - Replace the unconstrained package declaration with an exact, reviewed version. - Use a lock file generated from a trusted environment. 2. **Verify package integrity** - Record approved wheel hashes. - Install with hash enforcement, for example through a requirements file and `pip install --require-hashes -r requirements.txt`. - Prefer an internally mirrored or otherwise provenance-verified package source for managed deployments. 3. **Remove the unnecessary API-key requirement** - Remove `SIMMER_API_KEY` from `clawhub.json` if the report only performs local journal analysis. - Remove the API-key setup instructions from `README.md` and `SKILL.md`. - Delete the unused `get_client` function and associated client initialization code unless a future, documented feature genuinely requires it. 4. **Apply least privilege** - Run scheduled reports under a dedicated account with read-only access to the required journal. - Provide only the environment variables needed for local report generation. - Restrict outbound network access if the reporting workflow does not require networking. 5. **Reduce import-time execution** - Avoid invoking third-party package functions at module import time where practical. - Load the dependency only in the narrow execution path that needs it and handle configuration locally if the SDK is unnecessary. 6. **Add supply-chain controls** - Scan pinned dependencies for known vulnerabilities. - Review dependency updates before deployment. - Regenerate hashes only after validating the new package artifacts and behavior. ]]>