T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party Package Installation Enables Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md:14-18`; duplicated in `README.md:21-25` **Vulnerability Type**: Unpinned third-party dependency installed from a mutable public package repository **Risk Level**: Medium **Relevant code from `SKILL.md`:** ```markdown ## 安装 ```bash pip install cli-obsidian ``` ``` **Relevant code from `README.md`:** ```markdown ## 安装 ```bash pip install cli-obsidian ``` ``` ### Technical Analysis Both installation instructions direct users or AI agents to install `cli-obsidian` from the default Python Package Index without specifying an exact version, package hash, or trusted artifact source. Consequently, the code installed is determined at installation time rather than being fixed to the version reviewed with this skill. If the package owner account, publishing credentials, package namespace, or upstream release process is compromised, an attacker can publish a malicious newer release. Subsequent execution of the documented command would select that release. Python packages may execute build or installation logic, and their installed command-line entry points execute when users invoke `cli-obsidian`. The repository contains only documentation and metadata; it does not include source code, a lock file, hashes, signatures, or other material through which the installed package can be independently audited or verified. ### Attack Path 1. An attacker compromises the upstream package publisher, release pipeline, or associated PyPI credentials. 2. The attacker publishes a malicious version of `cli-obsidian`. 3. A user or AI agent follows the project documentation and runs `pip install cli-obsidian`. 4. Pip resolves the mutable package name to the attacker-controlled release because no version or hash is constrained. 5. Malicious package installation logic or the installed CLI entry point executes with the installing user's privileges. 6. The payload can access resour ...[truncated 916 chars]
- Remediation
- ## Remediation Suggestions - Pin the dependency to a reviewed exact version, for example: ```bash python -m pip install "cli-obsidian==1.0.0" ``` - Publish and document SHA-256 hashes for approved distribution artifacts, and use a hash-locked requirements file: ```text cli-obsidian==1.0.0 --hash=sha256:<verified-wheel-hash> ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Ensure the pinned version actually corresponds to a reviewed upstream release; project metadata alone does not verify the external package. - Provide a link to the canonical source repository and signed release artifacts so users can inspect provenance. - Protect package-publishing accounts with phishing-resistant multi-factor authentication and narrowly scoped, short-lived publishing tokens. - Recommend installation inside an isolated virtual environment and explicitly advise against running pip or the CLI with administrative privileges. - Apply the same corrected installation instructions consistently in both `SKILL.md` and `README.md`. - Establish a controlled update process in which new package versions are reviewed, scanned, hash-pinned, and tested before documentation is updated.