T08 · Insecure Dependencies
- Location
bootstrap_deps.sh:10- Finding
Unpinned Third-Party Package Is Automatically Downloaded and Executed
- Content
View full analysis
Vulnerability Details
File Location:
bootstrap_deps.sh, lines 10–23
Vulnerability Type: Supply-chain risk caused by an unpinned executable dependency
Risk Level: MediumVulnerable Code
bash REQ="clawfeedradar>=0.1.0" WORKSPACE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" PREFIX="$WORKSPACE/skills/clawfeedradar/.venv" echo "[clawfeedradar] installing/upgrading $REQ via pip..." >&2 if python -m pip install --upgrade "$REQ"; then echo "NEXT: clawfeedradar installed into the default Python environment." >&2 echo "NEXT: the skill runtime will import 'clawfeedradar.cli' via python -m." >&2 exit 0 fi echo "[clawfeedradar] default env pip install failed, trying workspace prefix..." >&2 mkdir -p "$PREFIX" if python -m pip install --upgrade "$REQ" --prefix "$PREFIX"; thenThe downloaded package is subsequently executed by
run_clawfeedradar.py, lines 30–40 and 78–86:python def _build_env() -> dict[str, str]: env = os.environ.copy() prefix = _workspace_root() / "skills" / "clawfeedradar" / ".venv" site_packages = _site_packages(prefix) if site_packages.exists(): pythonpath = env.get("PYTHONPATH", "") paths = [p for p in pythonpath.split(os.pathsep) if p] if pythonpath else [] if str(site_packages) not in paths: paths.insert(0, str(site_packages)) env["PYTHONPATH"] = os.pathsep.join(paths) return envpython def _run_cli(args: list[str]) -> Dict[str, Any]: cmd = [sys.executable, "-m", "clawfeedradar.cli"] + args proc = subprocess.run( cmd, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=_build_env(), )Technical Analysis
The installation hook accepts every release satisfying
clawfeedradar>=0.1.0and uses--upgrade. It does not enforce an audited exact version, package hash, signed artifact, or lock file. Consequently, the effective code exec ...[truncated 2590 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin the dependency to an audited exact version, for example:
bash REQ="clawfeedradar==0.1.0" -
Use a requirements lock file containing cryptographic hashes and install with hash enforcement:
bash python -m pip install \ --require-hashes \ --no-deps \ -r requirements.lock -
Pin and hash all transitive dependencies rather than allowing
pipto resolve changing versions. -
Remove unconditional
--upgradefrom the automatic install hook. Dependency upgrades should be explicit, separately reviewed operations. -
Prefer prebuilt, verified wheels and disable source builds where practical to reduce installation-time code execution:
bash python -m pip install \ --only-binary=:all: \ --require-hashes \ -r requirements.lock -
Install the dependency in a dedicated virtual environment owned by the Skill instead of first attempting to modify the default Python environment.
-
Replace
os.environ.copy()with an explicit environment-variable allowlist. Pass only variables required for the selected operation, and avoid exposing unrelated host secrets. -
Run the package under a restricted service identity or sandbox with narrowly scoped filesystem and network permissions. Limit knowledge-base access to read-only where feasible.
-
Disable Git publication by default and provide publication credentials only to an isolated publication step.
-
Establish a controlled dependency-update process that verifies package provenance, reviews release changes, scans artifacts, and tests the pinned package before deployment.
-