T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:64
- Finding
- Mutable Remote OpenAPI Schema Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:16-17`, `SKILL.md:64-68`, `SKILL.md:97`, `references/usage-patterns.md:5-9`, and `references/usage-patterns.md:62-65` **Vulnerability Type**: Mutable, unverified remote dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-17`: ```markdown - Access to the curated OpenAPI schema URL: - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json` ``` `SKILL.md:64-68`: ```markdown 1. Use the fixed link command by default: - `command -v coinapi-openapi-cli` - If missing, create it: `uxc link coinapi-openapi-cli https://rest.coinapi.io --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json` - `coinapi-openapi-cli -h` ``` `SKILL.md:97`: ```markdown - `coinapi-openapi-cli <operation> ...` is equivalent to `uxc https://rest.coinapi.io --schema-url <coinapi_openapi_schema> <operation> ...`. ``` `references/usage-patterns.md:5-9`: ```bash command -v coinapi-openapi-cli uxc link coinapi-openapi-cli https://rest.coinapi.io \ --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json coinapi-openapi-cli -h ``` `references/usage-patterns.md:62-65`: ```markdown ## Fallback Equivalence - `coinapi-openapi-cli <operation> ...` is equivalent to `uxc https://rest.coinapi.io --schema-url <coinapi_openapi_schema> <operation> ...`. ``` ### Technical Analysis The documented setup retrieves the OpenAPI schema from the mutable GitHub `main` branch. No immutable commit identifier, release tag, content digest, or signature verification is specified. Consequently, the schema consumed when a user creates the CLI may differ from the local schema that was included in and revie ...[truncated 2398 chars]
- Remediation
- ## Remediation Suggestions 1. Use the bundled schema by default: ```bash uxc link coinapi-openapi-cli https://rest.coinapi.io \ --schema-url ./references/coinapi-market.openapi.json ``` If UXC requires a different syntax for local files, use the corresponding local-file option and document the exact command. 2. If remote retrieval is operationally necessary, replace the `main` branch URL with a URL pinned to an immutable Git commit. 3. Publish the expected SHA-256 digest and verify the downloaded schema before passing it to UXC. Abort setup if verification fails. 4. Validate the schema after retrieval using an allowlist that enforces: - The server URL is exactly `https://rest.coinapi.io`. - Only the five documented paths are present. - Only the `GET` method is allowed. - Authentication uses the `X-CoinAPI-Key` header. - No external references or unexpected server overrides are present. 5. Update `scripts/validate.sh` to verify that documentation uses either the local schema or an immutable, integrity-checked remote source. 6. Review and rotate the pinned schema through an explicit release process rather than automatically trusting changes made to a mutable branch.