T08 · Insecure Dependencies
Warning
- Location
- README.md:34
- Finding
- Unpinned Third-Party Dependency Installed from a Mutable Git Repository## Vulnerability Details **File Location**: `README.md:34-38` **Vulnerability Type**: Supply-chain exposure through an unpinned executable dependency **Risk Level**: Medium **Vulnerable Code**: ```bash # Install SpotAPI dependency git clone https://github.com/ejatapibeda/SpotAPI.git pip install -e ./SpotAPI # alternative pip install git+https://github.com/ejatapibeda/SpotAPI.git ``` The same unsafe installation approach is also documented in `SKILL.md`, where users are instructed to clone SpotAPI and install it in editable mode without selecting a verified immutable revision. ### Technical Analysis The documented installation process retrieves and installs the current default branch of an external Git repository. It does not pin SpotAPI to a reviewed commit, verify a release signature, enforce a package hash, or use a locked dependency manifest. A Git branch is mutable. Consequently, the code installed by future users can differ from the code that existed when this Skill was audited. Python package installation may execute dependency-controlled build or installation logic. SpotAPI is particularly sensitive because the Skill passes reusable Spotify authentication cookies to its `SpotifySession.setup()` and `SpotifySession.load()` interfaces. There is no evidence in the audited project that the current SpotAPI source is malicious. The vulnerability is the lack of supply-chain integrity controls, which would allow a compromised or maliciously modified upstream dependency to execute within the user's environment. ### Attack Path 1. An attacker compromises the SpotAPI repository, its maintainer account, or the repository's default branch. 2. The attacker adds malicious runtime, build, or installation logic to SpotAPI. 3. A user follows the documented `git clone` and `pip install -e` instructions, or installs directly from the mutable Git URL. 4. The attacker's code executes with the privileges of the user running `pip ...[truncated 886 chars]
- Remediation
- ## Remediation Suggestions 1. Pin SpotAPI to a reviewed immutable commit rather than a branch: ```bash pip install "git+https://github.com/ejatapibeda/SpotAPI.git@REVIEWED_COMMIT_HASH" ``` 2. Prefer a versioned release artifact with cryptographic hashes and enforce hashes through a lock file or `requirements.txt`. 3. Avoid editable installations such as `pip install -e` for normal production use. 4. Record the exact reviewed SpotAPI version or commit in both `README.md` and `SKILL.md`. 5. Install the dependency in an isolated virtual environment with only the permissions needed for Spotify control. 6. Review dependency changes before updating the pinned revision. 7. Where available, verify signed tags or release attestations and use automated dependency integrity scanning.