T08 · Insecure Dependencies
Warning
- Location
- bootstrap_deps.sh:10
- Finding
- Unpinned Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `bootstrap_deps.sh`, lines 10–23 **Vulnerability Type**: Supply-chain risk caused by an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash REQ="clawfeedradar>=0.1.0" WORKSPACE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" PREFIX="$WORKSPACE/skills/clawfeedradar/.venv" echo "[clawfeedradar] installing/upgrading $REQ via pip..." >&2 if python -m pip install --upgrade "$REQ"; then echo "NEXT: clawfeedradar installed into the default Python environment." >&2 echo "NEXT: the skill runtime will import 'clawfeedradar.cli' via python -m." >&2 exit 0 fi echo "[clawfeedradar] default env pip install failed, trying workspace prefix..." >&2 mkdir -p "$PREFIX" if python -m pip install --upgrade "$REQ" --prefix "$PREFIX"; then ``` The downloaded package is subsequently executed by `run_clawfeedradar.py`, lines 30–40 and 78–86: ```python def _build_env() -> dict[str, str]: env = os.environ.copy() prefix = _workspace_root() / "skills" / "clawfeedradar" / ".venv" site_packages = _site_packages(prefix) if site_packages.exists(): pythonpath = env.get("PYTHONPATH", "") paths = [p for p in pythonpath.split(os.pathsep) if p] if pythonpath else [] if str(site_packages) not in paths: paths.insert(0, str(site_packages)) env["PYTHONPATH"] = os.pathsep.join(paths) return env ``` ```python def _run_cli(args: list[str]) -> Dict[str, Any]: cmd = [sys.executable, "-m", "clawfeedradar.cli"] + args proc = subprocess.run( cmd, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=_build_env(), ) ``` ### Technical Analysis The installation hook accepts every release satisfying `clawfeedradar>=0.1.0` and uses `--upgrade`. It does not enforce an audited exact version, package hash, signed artifact, or lock file. Consequently, the effective code exec ...[truncated 2590 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an audited exact version, for example: ```bash REQ="clawfeedradar==0.1.0" ``` 2. Use a requirements lock file containing cryptographic hashes and install with hash enforcement: ```bash python -m pip install \ --require-hashes \ --no-deps \ -r requirements.lock ``` 3. Pin and hash all transitive dependencies rather than allowing `pip` to resolve changing versions. 4. Remove unconditional `--upgrade` from the automatic install hook. Dependency upgrades should be explicit, separately reviewed operations. 5. Prefer prebuilt, verified wheels and disable source builds where practical to reduce installation-time code execution: ```bash python -m pip install \ --only-binary=:all: \ --require-hashes \ -r requirements.lock ``` 6. Install the dependency in a dedicated virtual environment owned by the Skill instead of first attempting to modify the default Python environment. 7. Replace `os.environ.copy()` with an explicit environment-variable allowlist. Pass only variables required for the selected operation, and avoid exposing unrelated host secrets. 8. Run the package under a restricted service identity or sandbox with narrowly scoped filesystem and network permissions. Limit knowledge-base access to read-only where feasible. 9. Disable Git publication by default and provide publication credentials only to an isolated publication step. 10. Establish a controlled dependency-update process that verifies package provenance, reviews release changes, scans artifacts, and tests the pinned package before deployment.