T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Mutable Remote OpenAPI Schema Bypasses the Audited Bundled Schema<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-38`; repeated in `references/usage-patterns.md:5-8` **Vulnerability Type**: Mutable remote dependency / time-of-use supply-chain substitution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:35-38`: ```markdown 1. Use the fixed link command by default: - `command -v defillama-openapi-cli` - If missing, create it: `uxc link defillama-openapi-cli https://api.llama.fi --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/defillama-openapi-skill/references/defillama-public.openapi.json` ``` `references/usage-patterns.md:5-8`: ```bash command -v defillama-openapi-cli uxc link defillama-openapi-cli https://api.llama.fi \ --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/defillama-openapi-skill/references/defillama-public.openapi.json defillama-openapi-cli -h ``` ### Technical Analysis The package contains an audited local schema at `references/defillama-public.openapi.json`, but its documented runtime workflow instead retrieves the schema from the mutable `main` branch of a GitHub repository. A branch URL is not an immutable dependency reference: its content can change after this skill has been reviewed or installed. Consequently, the schema consumed by UXC at execution time may differ from the bundled schema inspected during the audit. An upstream compromise, unauthorized repository change, or otherwise unsafe update could modify operation definitions, paths, parameters, or other generated CLI behavior without requiring any change to the installed package. This is classified as an insecure dependency rather than remote payload execution because the fetched resource is an OpenAPI schema, not a directly executed program. Nevertheless, it remains an unpinned external input that controls how the API client is constructed. ### Attack Path 1. An attacker compromises the upstream repository or obtains the ability to modify the referenced ...[truncated 1530 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use the bundled, reviewed schema as the default dependency: ```bash uxc link defillama-openapi-cli https://api.llama.fi \ --schema-url ./references/defillama-public.openapi.json ``` Adjust the path resolution as necessary so it remains anchored to the installed skill directory rather than the caller’s working directory. 2. If remote retrieval is operationally required, pin the URL to an immutable Git commit instead of `main`: ```text https://raw.githubusercontent.com/holon-run/uxc/<full-commit-hash>/skills/defillama-openapi-skill/references/defillama-public.openapi.json ``` 3. Publish and verify a cryptographic digest, such as SHA-256, before passing a downloaded schema to UXC. Fail closed if verification does not succeed. 4. Update both `SKILL.md` and `references/usage-patterns.md` so all documented workflows use the same pinned or local schema source. 5. Extend `scripts/validate.sh` to reject schema URLs containing mutable branch references such as `/main/` and to verify that documented remote references use an approved commit and expected digest. 6. Review schema updates through the same security process as package code, including confirmation that only the intended HTTPS server and read-only operations are present. ]]>