T08 · Insecure Dependencies
Error
- Location
- SKILL.md:22
- Finding
- Execution of Unbundled and Unaudited Code Outside the Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-32` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash cd {baseDir}/../../ && uv run python main.py check --config "<config_path>" --format json ``` ```bash cd {baseDir}/../../ && uv run python main.py check --auto --format json ``` ### Technical Analysis The skill instructs the agent to leave the audited skill directory and execute `main.py` from a parent project directory. The audited package does not contain `main.py`, a dependency manifest, a lockfile, or the source code implementing the advertised security checks. As a result, the effective executable is outside the reviewed package boundary. Its behavior depends on mutable parent-directory content and on the Python environment selected or resolved by `uv run`. The artifact therefore cannot guarantee that the executed code is the intended non-invasive configuration checker. This also creates a trust-boundary problem: reviewing or installing the skill does not establish the integrity of the code that will run when the skill is invoked. ### Attack Path 1. An attacker gains the ability to create or replace `main.py` in the directory resolved by `{baseDir}/../../`, or modifies the dependency configuration used by `uv`. 2. A user invokes SafeClaw to inspect a configuration file. 3. The agent follows the documented command and changes into the parent project directory. 4. `uv run python main.py` executes the attacker-controlled or otherwise unaudited code. 5. The code runs with the privileges and filesystem/network access of the agent process. ### Impact Assessment Successful exploitation can result in arbitrary code execution under the account running the agent. Depending on the surrounding runtime permissions, the executed code could: - Read the configuration file supplied for analysis. - Access other files readable by the agent account. - Modify files writable by that account. - U ...[truncated 324 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the complete checker implementation inside the skill package. 2. Invoke the checker using a canonical path located beneath `{baseDir}` rather than changing to a parent directory. 3. Resolve and verify the executable path before invocation, and fail closed if it escapes the skill directory. 4. Include a version-controlled dependency manifest and a lockfile with integrity information. 5. Install dependencies from explicitly approved registries and pin all dependency versions. 6. Run the checker in a restricted environment with read-only access to the selected configuration file and no unnecessary network access. 7. Document and verify the expected hash or signature of the checker entry point before execution. ]]>