T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned External Package Is Installed and Executed Without Locally Auditable Source## Vulnerability Details **File Location**: `SKILL.md`, lines 14–29 **Vulnerability Type**: Unpinned and externally retrieved executable dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### 1. Install ```bash pip install decompose-mcp ``` ### 2. Configure MCP Server Add to your OpenClaw MCP config: ```json { "mcpServers": { "decompose": { "command": "python3", "args": ["-m", "decompose", "--serve"] } } } ``` ``` ### Technical Analysis The Skill directs users to install `decompose-mcp` from PyPI without specifying an exact version or cryptographic hash. It then configures the downloaded package to run as an MCP server through `python3 -m decompose --serve`. The audited project contains only `SKILL.md` and `claw.json`; it does not contain the package implementation, a lock file, artifact hashes, or other material that would allow the code ultimately executed by the user to be verified against this audit. The references to public source code, GitHub Actions, and PyPI Trusted Publishing improve traceability but do not cryptographically bind this installation command to a reviewed artifact. No evidence establishes that the current PyPI package is malicious. The confirmed weakness is that the installation process trusts mutable external package resolution and immediately executes the resulting code. A future compromised release, publisher-account compromise, build-pipeline compromise, or unexpected package update could therefore change the effective payload after the Skill itself has been reviewed. The Skill also declares the `network` permission in `claw.json`, which is reasonably required for its optional URL-fetching feature. However, because the installed implementation is not present in the artifact, the documented SSRF controls and limitation of outbound requests to user-selected URLs cannot be independently verified by this audit. ### Attack Path 1. ...[truncated 1424 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, for example `decompose-mcp==X.Y.Z`, rather than allowing installation of the latest available release. 2. Distribute and verify cryptographic hashes using a locked requirements file and an installer mode equivalent to `pip install --require-hashes`. 3. Include the reviewed source in the Skill artifact or provide a reproducible-build process that binds the published wheel to a specific reviewed source commit. 4. Record the expected wheel filename, SHA-256 digest, source commit, and provenance attestation in the installation documentation. 5. Run the MCP server under a dedicated, unprivileged account or sandbox with read-only filesystem access except for explicitly required paths. 6. Restrict outbound network access to the minimum needed for `decompose_url`. If only local text processing is required, disable network access entirely. 7. Treat submitted documents and URLs as untrusted input and avoid exposing unrelated credentials or sensitive environment variables to the MCP process. 8. Independently test the package’s documented SSRF defenses, including redirects, DNS rebinding, alternative IP representations, IPv4-mapped IPv6 addresses, and post-resolution connection behavior.