T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Dependencies Create a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:8-29` and `SKILL.md:68` **Vulnerability Type**: Unpinned and non-hash-verified Python dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: { "openclaw": { "install": [ { "id": "pip-deps", "kind": "python", "package": "akshare", "label": "Install AkShare" }, { "id": "pip-deps", "kind": "python", "package": "pandas", "label": "Install Pandas" }, { "id": "pip-deps", "kind": "python", "package": "numpy", "label": "Install NumPy" } ] } } ``` ```bash pip install akshare pandas numpy ``` ### Technical Analysis The Skill declares and recommends installing `akshare`, `pandas`, and `numpy` without exact version constraints, integrity hashes, or a lock file. Consequently, dependency resolution is mutable: two installations performed at different times can retrieve different artifacts without any change to the audited Skill. The package names appear consistent with the script's imports, and there is no evidence that the project intentionally references a typosquatted package or an unauthorized package index. The risk arises from implicitly trusting whichever compatible releases and transitive dependencies the package installer resolves at installation time. If an upstream release, dependency, package-index account, or distribution artifact is compromised, code outside the reviewed repository may execute under the user's identity. ### Attack Path 1. An attacker compromises an upstream dependency release, one of its transitive dependencies, a maintainer account, or the package-distribution channel. 2. The attacker publishes a malicious version under a dependency name used by the Skill. 3. A user installs the dependencies usin ...[truncated 1185 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version instead of allowing unconstrained resolution. 2. Generate a lock file that also fixes transitive dependencies. Suitable approaches include `pip-tools`, Poetry, or another reproducible dependency-management system. 3. Require cryptographic hashes for downloaded artifacts, for example through a hash-locked requirements file and `pip install --require-hashes`. 4. Configure installation to use an explicitly trusted package index and prevent unintended fallback to untrusted indexes. 5. Install dependencies in an isolated virtual environment under a non-privileged account; do not run package installation as root. 6. Scan and periodically review pinned dependencies for known vulnerabilities and anomalous ownership or release changes. 7. Update both the `openclaw.install` metadata and the documented installation command so they enforce the same reviewed versions. 8. Test dependency upgrades in a controlled environment before updating pins and hashes.