T08 · Insecure Dependencies
Warning
- Location
- package.json:19
- Finding
- Unpinned, Mutable, and Unnecessary Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Locations**: - `package.json:19-23` - `README.md:6` - `README.md:14` - `SKILL.md:18` - `SKILL.md:113` - `PUBLISH_GUIDE.md:20-22` - `PUBLISH_GUIDE.md:76-80` **Vulnerability Type**: Supply-chain exposure through unconstrained package versions, mutable package execution, and an unnecessary dependency **Risk Level**: Medium ### Vulnerable Code and Instructions `package.json:19-23`: ```json "dependencies": { "requests": "*", "mutagen": "*", "python-pptx": "*" }, ``` `README.md:6`: ```bash npx clawhub@latest install music-player ``` `README.md:14`: ```bash pip install requests mutagen ``` `SKILL.md:18`: ```bash pip install requests mutagen python-pptx ``` `SKILL.md:113`: ```text 1. Ensure mutagen is installed: `pip install mutagen` ``` `PUBLISH_GUIDE.md:20-22`: ```text - requests - mutagen - python-pptx ``` `PUBLISH_GUIDE.md:76-80`: ```json { "requests": "*", "mutagen": "*", "python-pptx": "*" } ``` ### Technical Analysis The project does not constrain dependency versions. The wildcard entries in `package.json` and the unpinned `pip install` commands cause package managers to resolve whichever versions are current at installation time. Consequently, the installed code can differ from the code that was originally reviewed. The command `npx clawhub@latest` has the same mutability problem and may download and execute the latest published package rather than a specifically audited release. In addition, `python-pptx` is not imported by any of the audited Python scripts and is unrelated to the implemented music-search, download, playback, and metadata functionality. Installing it unnecessarily increases the dependency tree and supply-chain attack surface. The manifest also places Python package names under the npm `dependencies` field. If a user runs `npm install`, npm will resolve packages from the npm registry rather than installing the intended Python packages from PyPI. This ecosystem mismatch ca ...[truncated 1820 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the unused `python-pptx` dependency unless a documented and reviewed feature genuinely requires it. 2. Move Python dependencies out of the npm `dependencies` field and define them in an appropriate Python dependency file, such as `requirements.txt` or `pyproject.toml`. 3. Pin every direct Python dependency to a reviewed version rather than relying on unconstrained resolution. 4. Generate and retain a lockfile with cryptographic hashes, using tools such as `pip-tools`, Poetry, or an equivalent reproducible dependency-management workflow. 5. Install Python packages with hash verification where practical, for example through `pip install --require-hashes -r requirements.txt`. 6. Replace `npx clawhub@latest` with a specific, reviewed version and document the expected package integrity information. 7. Review transitive dependencies and use automated vulnerability scanning before publishing releases. 8. Configure trusted registries explicitly and avoid mixing npm and PyPI dependency declarations. 9. Update `README.md`, `SKILL.md`, and `PUBLISH_GUIDE.md` so every installation example uses the same pinned and reproducible dependency set. ]]>