T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party CLI Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 10; repeated at lines 17–20 **Vulnerability Type**: Unpinned package installation and supply-chain exposure **Risk Level**: Medium **Vulnerable code:** ```yaml install: uv tool install otterai-cli ``` The same installation behavior is documented again: ```bash Install with: ```bash uv tool install otterai-cli ``` ``` ### Technical Analysis The Skill instructs the environment to install `otterai-cli` without specifying an exact version, package hash, trusted artifact URL, lockfile, or signature verification procedure. Consequently, the package resolver may install whichever release is current at installation time rather than the release reviewed when this Skill was published. This creates a supply-chain trust boundary in which package registry compromise, publisher account compromise, or a malicious future release could change the code executed by the Skill without requiring any modification to this repository. The package runs with the invoking user's privileges and is expected to process the sensitive `OTTERAI_USERNAME` and `OTTERAI_PASSWORD` environment variables declared at lines 7–8. It may also access credentials stored through the operating-system keychain or the documented `~/.otterai/config.json` fallback and interact with private meeting transcripts and recordings. No evidence establishes that the current package is malicious. The vulnerability is the mutable and unverified dependency installation process. ### Attack Path 1. An attacker compromises the package publisher account or package registry, or causes a malicious release of `otterai-cli` to become the version selected by the package resolver. 2. A user or agent follows the Skill's installation instruction: ```bash uv tool install otterai-cli ``` 3. Because no version or artifact hash is pinned, the resolver retrieves and installs the attacker-controlled release. 4. Pa ...[truncated 1437 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version in both the metadata and installation documentation, for example: ```yaml install: uv tool install "otterai-cli==<reviewed-version>" ``` 2. Require integrity verification using trusted package hashes or signed release artifacts. Maintain reviewed hashes alongside the Skill and fail installation if verification does not succeed. 3. Document the canonical publisher, package index, and source repository so users can verify package provenance and detect dependency-confusion or publisher-substitution attempts. 4. Use an approved private package mirror or allowlist where practical, and prevent fallback to untrusted indexes. 5. Review every dependency update before changing the pinned version. Use automated vulnerability and provenance scanning, but do not automatically deploy unreviewed releases. 6. Run the CLI with least privilege in an isolated environment. Limit filesystem, network, keychain, and environment-variable access to what is necessary for Otter operations. 7. Avoid exposing username and password variables to unrelated processes. Prefer short-lived, narrowly scoped authentication tokens where the service supports them, and ensure secrets are never logged. 8. Keep the installation command at line 10 and the documented command at line 19 synchronized so neither path permits an unpinned installation.