T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:57
- Finding
- Mutable Remote OpenAPI Schema Weakens Supply-Chain Integrity## Vulnerability Details **File Location**: `SKILL.md:57-60`; duplicated in `references/usage-patterns.md:5-9` **Vulnerability Type**: Unpinned remote dependency **Risk Level**: Medium **Vulnerable code in `SKILL.md`:** ```bash 1. Use the fixed link command by default: - `command -v chainbase-openapi-cli` - If missing, create it: `uxc link chainbase-openapi-cli https://api.chainbase.online --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/chainbase-openapi-skill/references/chainbase-web3.openapi.json` - `chainbase-openapi-cli -h` ``` **Duplicated vulnerable code in `references/usage-patterns.md`:** ```bash command -v chainbase-openapi-cli uxc link chainbase-openapi-cli https://api.chainbase.online \ --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/chainbase-openapi-skill/references/chainbase-web3.openapi.json chainbase-openapi-cli -h ``` ### Technical Analysis The generated CLI is linked using an OpenAPI schema downloaded from the mutable `main` branch of an external GitHub repository. No immutable commit reference, version tag with integrity verification, or cryptographic digest is specified. The project includes a locally reviewable schema at `references/chainbase-web3.openapi.json`, but the documented runtime workflow does not use it. Consequently, the effective API definition used after installation can differ from the artifact reviewed during this audit. If the upstream repository, account, branch, or delivery path is compromised, an attacker could alter the remotely supplied schema. Depending on UXC's schema processing behavior, this could change the available operations, request parameters, or request construction associated with the generated CLI. The reviewed local schema itself only defines seven GET operations and does not contain an executable payload. ### Attack Path 1. An attacker obtains permission to modify the referenced upstrea ...[truncated 1637 chars]
- Remediation
- ## Remediation Suggestions 1. Use the bundled schema as the default source: ```bash uxc link chainbase-openapi-cli https://api.chainbase.online \ --schema-url ./references/chainbase-web3.openapi.json ``` 2. If remote retrieval is required, pin the URL to an immutable Git commit rather than `main`: ```text https://raw.githubusercontent.com/holon-run/uxc/<full-commit-sha>/skills/chainbase-openapi-skill/references/chainbase-web3.openapi.json ``` 3. Publish and verify a SHA-256 digest before passing the schema to UXC. Abort linking when verification fails. 4. Update `scripts/validate.sh` to ensure documentation does not reference mutable branches and that any remote schema digest matches the bundled schema. 5. Keep the API host allowlist and HTTPS credential binding. Additionally, validate that the loaded schema: - Uses only `https://api.chainbase.online`. - Contains only the intended seven GET operations. - Defines no write methods. - Retains `X-API-KEY` as the expected authentication header. 6. Apply the same corrected command in both `SKILL.md` and `references/usage-patterns.md` to prevent users from following an obsolete insecure setup path.