T08 · Insecure Dependencies
Warning
- Location
- scripts/okx_analyst.py:829
- Finding
- Default Execution of Unverified External Skill Scripts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/okx_analyst.py`, lines 829–910 and 1055–1095 **Vulnerability Type**: Unverified local dependency execution **Risk Level**: Medium ### Vulnerable Code ```python def fetch_crypto_news(symbol, limit=5, lang='zh-CN', max_age_hours=24): """从NS3 API获取加密货币新闻 (通过Node.js脚本) 只保留最近 max_age_hours 小时内的新闻""" import subprocess base_symbol = extract_base_symbol(symbol) try: # 调用Node.js脚本获取新闻，获取更多然后过滤 script_path = '/Users/yirongcao/.openclaw/skills/crypto-monitor/scripts/news.js' cmd = ['node', script_path, f'--coin={base_symbol}', f'--lang={lang}', f'--limit={max(20, limit * 4)}'] result = subprocess.run(cmd, capture_output=True, text=True, timeout=30) ``` ```python def fetch_wire_news(symbol, limit=5, max_age_hours=24): """从通讯社RSS获取新闻 只保留最近 max_age_hours 小时内的新闻""" import subprocess from datetime import datetime try: # 调用wire-news脚本，获取更多然后过滤 script_path = '/Users/yirongcao/.openclaw/skills/wire-news-aggregator/scripts/wire_news.py' cmd = ['python3', script_path, '--limit', str(max(20, limit * 4)), '--json'] result = subprocess.run(cmd, capture_output=True, text=True, timeout=60) ``` The external scripts are invoked by default through the following command-line and control-flow configuration: ```python parser.add_argument('-n', '--news', action='store_true', default=True, help='获取相关新闻 (默认开启)') parser.add_argument('--no-news', action='store_true', help='禁用新闻') ``` ```python # 获取相关新闻 - NS3 + 通讯社 ns3_items = [] wire_items = [] if not args.no_news: print(f"📰 正在获取新闻 (NS3 + 通讯社) [过滤24小时内]...", file=sys.stderr) try: # NS3加密货币新闻 - 只保留24小时内 ns3_items = fetch_crypto_news(args.symbol, limit=5, lang='zh-CN', max_age_hours=24) if not ns3_items: ns3_items = fetch_crypto_news(args.symbol, limit=5, lang='en', max_age_hours=24) if ns3_items: print(f"✅ NS3: ...[truncated 3496 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove cross-Skill subprocess execution** - Fetch news through reviewed code contained within this project. - Use a documented HTTPS API client with an explicit destination allowlist and strict timeouts. 2. **Make news integration opt-in** - Set the news flag's default to disabled. - Require an explicit `--news` option before contacting news services or launching auxiliary components. - Remove the conflicting `action='store_true', default=True` configuration. 3. **Declare and verify external components** - If external scripts must remain supported, expose their paths through explicit configuration rather than developer-specific absolute paths. - Document their package names, versions, expected hashes, permissions, and network behavior. - Verify a cryptographic digest or signed manifest before every execution. 4. **Constrain the execution boundary** - Run auxiliary components with a minimal environment rather than inheriting all environment variables. - Use a dedicated low-privilege account or sandbox with restricted filesystem and network access. - Do not expose OKX credentials to news-related subprocesses. 5. **Bundle immutable reviewed dependencies** - Include required helper code in the audited package or use version-pinned packages from trusted repositories. - Maintain a lock file and integrity hashes for third-party dependencies. 6. **Fail transparently** - Report that a configured dependency is missing or failed integrity validation instead of silently treating all subprocess failures as an empty news result. ]]>