T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Package Installation in a Wallet-Signing Workflow## Vulnerability Details **File Location**: `SKILL.md`, lines 27-31 **Vulnerability Type**: Supply-chain exposure through an unpinned dependency **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash First, check if clawpay is installed: pip3 show clawpay If not installed: pip3 install clawpay ``` ### Technical Analysis The Skill instructs the agent to install `clawpay` directly from the default Python package index without specifying an exact version or validating an integrity hash. Consequently, the package installed during execution may differ from the package that existed when the Skill was reviewed. This is especially sensitive because the installed SDK is subsequently imported into a process that reads a Solana private keypair and performs signed financial transactions. Python package initialization and imported modules can execute arbitrary code with the privileges of the agent process. The repository does not bundle or lock the dependency's source, so the effective SDK implementation cannot be audited from this artifact. This finding does not establish that the current `clawpay` package is malicious. The vulnerability is the absence of version and integrity controls around a security-sensitive dependency. ### Attack Path 1. An attacker compromises the package publisher account, the package registry, or an upstream release process. 2. The attacker publishes a modified `clawpay` release under the expected package name. 3. The agent runs `pip3 install clawpay`, which resolves and installs the modified release without a version or hash check. 4. The workflow imports `Client` from the installed package while operating in a wallet-signing context. 5. Malicious package code executes with the privileges of the agent process. 6. The code may read accessible files or environment variables, interfere with transaction construction, substitute recipient addresses, or capture wallet key material when it is pass ...[truncated 602 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, for example `clawpay==X.Y.Z`. 2. Install from a lock file with cryptographic hashes, using a command such as `pip install --require-hashes -r requirements.txt`. 3. Verify the package publisher, source repository, release provenance, and package contents before approval. 4. Use an isolated virtual environment rather than installing into a shared Python environment. 5. Prevent automatic dependency upgrades in production wallet-signing environments. 6. Review the complete transitive dependency tree and pin those packages as well. 7. Run the SDK in a restricted process with minimal filesystem and network permissions. 8. Prefer an external or hardware-backed signer so dependency code never receives raw private-key material.