T08 · Insecure Dependencies
Warning
- Location
- api.md:45
- Finding
- Unpinned Community Dependencies Receive an Account Authentication Token<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:77-86` - `SKILL.md:110-118` - `api.md:1-10` - `api.md:45-58` - `api.md:129-141` **Vulnerability Type**: Unpinned and unaudited third-party dependencies with access to sensitive credentials **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:77-86`: ```markdown ### Python Wrapper (Recommended) ```bash pip install udio_wrapper ``` ```python from udio_wrapper import UdioWrapper # Initialize with auth token udio = UdioWrapper("your-sb-api-auth-token") ``` ``` `SKILL.md:110-118`: ```markdown ### TypeScript/Node Wrapper ```bash npm install udio-wrapper ``` ```typescript import { createUdioWrapper } from 'udio-wrapper'; const client = await createUdioWrapper('your-auth-token'); ``` ``` `api.md:1-10`: ```markdown # API Reference — Udio Udio has no official public API. Community wrappers interact with the internal API. ## Available Wrappers | Wrapper | Language | Install | Repo | |---------|----------|---------|------| | udio_wrapper | Python | `pip install udio_wrapper` | github.com/flowese/UdioWrapper | | udio-wrapper | TypeScript | `npm install udio-wrapper` | github.com/josephgodwinkimani/udio-wrapper | ``` `api.md:45-58`: ```markdown ## Python Wrapper (udio_wrapper) ### Installation ```bash pip install udio_wrapper # or from source pip install git+https://github.com/flowese/UdioWrapper.git ``` ### Basic Usage ```python from udio_wrapper import UdioWrapper udio = UdioWrapper(auth_token) ``` ``` `api.md:129-141`: ```markdown ## TypeScript/Node Wrapper (udio-wrapper) ### Installation ```bash npm install udio-wrapper ``` ### Node.js Usage ```typescript import { createUdioWrapper } from 'udio-wrapper/node'; async function generateMusic() { const client = await createUdioWrapper(process.env.UDIO_AUTH_TOKEN); ``` ``` ### Technical Analysis The Skill recommends installing Python and npm packages without pinning an exact package version, integrity hash, or audited sour ...[truncated 2757 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin immutable dependency versions** - Specify exact Python and npm package versions rather than installing the latest available release. - Replace the mutable Git installation with an audited full commit hash. 2. **Verify dependency integrity** - Use Python requirements files with hashes and install with `pip --require-hashes`. - Commit npm lockfiles and use `npm ci` rather than unconstrained installation. - Verify package provenance, signatures, and checksums where supported. 3. **Audit the dependency source** - Review the exact wrapper release and all relevant transitive dependencies before recommending it. - Record the reviewed package version or commit in the Skill documentation. - Repeat the audit before upgrading. 4. **Reduce credential exposure** - Prefer an official API with scoped and revocable credentials if one becomes available. - Avoid passing a full browser-session credential to third-party code where possible. - Never place the token directly in source code, command history, logs, or project memory. - Document token revocation and immediate rotation procedures following suspected compromise. 5. **Isolate execution** - Run the wrapper in a dedicated virtual environment, container, or restricted user account. - Limit filesystem access to required Udio project directories. - Restrict outbound network access to verified Udio endpoints where operationally feasible. - Avoid exposing unrelated secrets or environment variables to the wrapper process. 6. **Harden installation guidance** - Warn users explicitly that package installation executes third-party code. - Require user confirmation before installing or updating a wrapper. - Preserve prompt-only and direct-browser workflows as lower-supply-chain-risk alternatives. ]]>