T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Third-Party Dependency and Unverified Runtime Model Retrieval## Vulnerability Details **File Location**: `requirements.txt:1` **Related Locations**: `README.md:4-8`, `README.md:138-144`, `SKILL.md:185-190`, `SKILL.md:388-390` **Vulnerability Type**: Third-party supply-chain exposure **Risk Level**: Medium **Complete Vulnerable Code Snippet**: ```text rapidocr-onnxruntime>=1.2.3 ``` The documented installation and runtime behavior is: ```bash pip install rapidocr-onnxruntime ``` ```text The first run downloads a model of approximately 100 MB. ``` ### Technical Analysis The dependency specification provides only a minimum version and does not constrain installation to a specific audited release. A normal package installation can therefore resolve to any later compatible version available from the configured Python package index. The project also provides no lock file or package hashes with which to verify the resolved distribution. In addition, project documentation states that the dependency downloads OCR model data during first use. The repository does not identify or pin the model version, source URL, or cryptographic digest. Consequently, the executable Python dependency and the model artifact used at runtime are not reproducible or independently integrity-verified by this project. This behavior also conflicts with the declaration in `claw.json` that the skill performs no network access. Although no direct network client is implemented in `rapidocr_minimal.py`, network activity may occur transitively through `rapidocr-onnxruntime`. ### Attack Path 1. An attacker compromises an eligible future release of `rapidocr-onnxruntime`, its distribution account, package-index delivery path, or the upstream model distribution channel. 2. A user follows the documented command or installs `requirements.txt`. 3. Because the requirement accepts every version at or above `1.2.3`, the package manager can select the compromised release without requiring a repository change. ...[truncated 1090 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `rapidocr-onnxruntime` to an exact release that has been reviewed, for example using `rapidocr-onnxruntime==<audited-version>`. 2. Generate a reproducible lock file and require cryptographic hashes during installation, such as through a hash-locked requirements file and `pip install --require-hashes`. 3. Record the authoritative source, exact version, and SHA-256 digest of every OCR model. 4. Verify each model's digest before loading it and reject missing or mismatched artifacts. 5. Where licensing and package-size constraints permit, distribute the verified model with the skill rather than downloading it at runtime. 6. If runtime retrieval remains necessary, restrict downloads to an authenticated HTTPS origin, prevent redirects to untrusted hosts, use a trusted local cache, and fail closed on verification errors. 7. Update `claw.json` and the documentation so the network behavior is represented accurately. Do not claim fully offline operation until all required artifacts have already been installed and verified. 8. Add automated dependency and artifact provenance checks to the release process.