T08 · Insecure Dependencies
Warning
- Location
- setup.sh:4
- Finding
- Unpinned Third-Party Dependencies Permit Supply-Chain Code Execution## Vulnerability Details **File Location**: `setup.sh`, line 4 **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium **Complete Code Snippet**: ```bash #!/bin/bash set -e echo "Installing flightclaw dependencies..." pip install flights "mcp[cli]" mkdir -p "$(dirname "$0")/data" echo "Done. flightclaw is ready to use." ``` ### Technical Analysis The setup script installs `flights` and `mcp[cli]` without exact version constraints, a lock file, or cryptographic hashes. Consequently, installation is not reproducible and implicitly trusts whichever package releases and transitive dependencies the package index serves at execution time. Python packages may execute code during installation or later when imported. A compromised package publisher account, malicious replacement release, dependency-confusion condition, or compromised transitive dependency could therefore turn the documented installation process into arbitrary local code execution. The documentation also recommends an unpinned installation command at `SKILL.md:14`: ```bash npx skills add jackculpan/flightclaw ``` Dynamic package retrieval through `npx` adds another mutable supply-chain dependency unless the launcher and retrieved artifact are pinned and verified. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, its publisher account, or an applicable package-distribution source. 2. The attacker publishes a malicious release or causes malicious package content to be selected during dependency resolution. 3. A user follows the documented setup process and runs `setup.sh`. 4. `pip install flights "mcp[cli]"` resolves and downloads the mutable dependency release without hash verification. 5. Malicious installation hooks execute immediately, or malicious package code executes when `server.py` or a script imports the dependency. 6. The payload operates with the privileges an ...[truncated 651 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 2. Generate and commit a lock file containing all transitive dependencies and SHA-256 hashes using a tool such as `pip-tools`. 3. Install only from explicitly trusted package indexes and disable unintended extra indexes to reduce dependency-confusion exposure. 4. Review new dependency versions before updating pins, and use automated vulnerability and provenance scanning in CI. 5. Run installation in an isolated virtual environment as a non-privileged user; do not recommend `sudo pip install`. 6. Pin and verify any `npx` launcher and downloaded Skill revision rather than relying on mutable names or branches. 7. Consider producing signed release artifacts and documenting checksum or signature verification for manual installation.