T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party CLI Installation from Mutable Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4-15` **Vulnerability Type**: Third-party supply-chain exposure through unpinned installation sources **Risk Level**: Medium ### Vulnerable Code ```yaml homepage: https://github.com/antoniorodr/memo metadata: {"clawdbot":{"emoji":"📝","os":["darwin"],"requires":{"bins":["memo"]},"install":[{"id":"brew","kind":"brew","formula":"antoniorodr/memo/memo","bins":["memo"],"label":"Install memo via Homebrew"}]}} --- # Apple Notes CLI Use `memo notes` to manage Apple Notes directly from the terminal. Create, view, edit, delete, search, move notes between folders, and export to HTML/Markdown. Setup - Install (Homebrew): `brew tap antoniorodr/memo && brew install antoniorodr/memo/memo` - Manual (pip): `pip install .` (after cloning the repo) - macOS-only; if prompted, grant Automation access to Notes.app. ``` ### Technical Analysis The skill instructs users to install the `memo` executable from a third-party personal Homebrew tap. Neither the Homebrew installation metadata nor the documented command pins an audited release, immutable commit, package digest, or cryptographic signature. The alternative installation procedure is also underspecified: it directs users to run `pip install .` after cloning “the repo” without stating an immutable revision, an exact clone command, or an integrity-verification procedure. Python package installation can execute package build hooks and other packaging logic from the cloned working tree. This creates a supply-chain trust boundary that cannot be verified from the skill artifact. The artifact contains only documentation and metadata; it does not include the dependency implementation. Consequently, the audit found no evidence that the current upstream dependency is malicious, but the installation procedure remains vulnerable to future upstream compromise, repository substitution, or installation from an unintended revision. The consequences are amplified because th ...[truncated 1721 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific audited release and, where supported, an immutable source commit. 2. Verify downloaded release artifacts with published SHA-256 or stronger checksums and preferably cryptographic signatures. 3. Replace the ambiguous “after cloning the repo” instruction with the exact HTTPS repository URL and a command that checks out a reviewed commit or signed tag. 4. Avoid recommending `pip install .` from an unspecified working tree. Use a version-pinned, trusted package source or a verified source archive instead. 5. Pin the Homebrew formula or release artifact where operationally possible, and document that a personal tap is a third-party trust boundary. 6. Review the dependency's formula, Python packaging hooks, and executable source before approving a new version. 7. Run the CLI under a least-privileged macOS account and grant only the Automation permissions necessary for Apple Notes operations. 8. Document how users can revoke Notes Automation access and remove the dependency if its integrity becomes uncertain. ]]>