T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Package Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 35-49; equivalent unpinned `uvx --from genai-calling` commands recur throughout the document. **Vulnerability Type**: Supply-chain risk caused by retrieving and executing an unpinned package **Risk Level**: Medium **Complete Code Snippet**: ```bash # 3) Text (cd "<SKILL_BASE_DIR>" && uvx --from genai-calling genai --model openai:gpt-4o-mini --prompt "Hello") # 4) See what you can use (requires at least one provider key configured) (cd "<SKILL_BASE_DIR>" && uvx --from genai-calling genai model available --all) ``` ```bash python -m pip install --upgrade genai-calling (cd "<SKILL_BASE_DIR>" && genai --model openai:gpt-4o-mini --prompt "Hello") ``` ### Technical Analysis The documented commands do not pin `genai-calling` to an audited version and do not verify a package hash or signature. The `uvx --from genai-calling` workflow can retrieve and immediately execute the version currently selected by the external package registry. Similarly, `pip install --upgrade genai-calling` explicitly permits replacing an installed version with a newer, unreviewed release. The repository contains only `SKILL.md`; it does not include the downloaded package's source, a lock file, package hashes, or signature-verification instructions. Consequently, the effective executable payload can change after this Skill has been reviewed. This is particularly sensitive because the resulting process is expected to receive provider API keys through process environment variables or `.env` files. This finding does not establish that the current published package is malicious. The vulnerability is the absence of controls preventing a compromised registry account, compromised maintainer, malicious future release, or package-resolution attack from introducing unreviewed executable code. ### Attack Path 1. An attacker compromises the package publishe ...[truncated 1754 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every executable package reference to an exact reviewed version, for example: ```bash uvx --from "genai-calling==X.Y.Z" genai ... python -m pip install "genai-calling==X.Y.Z" ``` 2. Publish and verify cryptographic hashes for approved distributions. Prefer installation through a locked requirements file with `--require-hashes`. 3. Remove `--upgrade` from normal usage instructions. Upgrades should occur only through an explicit review and validation process. 4. Use a lock file or controlled internal package mirror so package resolution is reproducible. 5. Verify release signatures or attestations where supported and document the expected publisher identity. 6. Execute the package in a constrained environment with only the credentials and filesystem paths required for the requested operation. 7. Recommend restrictive permissions for credential files, such as: ```bash chmod 600 ~/.genai-calling/.env ``` 8. Avoid placing credentials for unrelated projects or providers in the shared user-wide file. Prefer narrowly scoped, project-specific credentials and short-lived tokens where available.