T08 · Insecure Dependencies
Note
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party Python Dependency## Vulnerability Details **File Location**: `SKILL.md:6` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Vulnerable Code ```yaml metadata: { "openclaw": { "emoji": "🌤️", "requires": { "bins": ["python"], "pip": ["requests"] } } } ``` ### Technical Analysis The Skill declares `requests` as an automatically installed dependency without specifying an audited version or package hash. Consequently, dependency resolution can select a different package release whenever the Skill is installed. This makes installation non-reproducible and exposes it to upstream package compromise, package-index compromise, or an unexpectedly incompatible future release. No evidence indicates that the current `requests` package is malicious. The risk arises because the Skill does not constrain or verify the code retrieved from the package source. The runtime network request in `weather-cn.py:47-59` is not sensitive-data exfiltration. It sends a public city code over HTTPS to the declared weather provider, `www.weather.com.cn`, and is necessary for the advertised weather-query functionality. ### Attack Path 1. An attacker compromises the configured Python package index, the upstream dependency release process, or an unconstrained transitive dependency. 2. The Agent installs the Skill in a new environment. 3. The package resolver retrieves the attacker-controlled or compromised dependency because no version or integrity hash is enforced. 4. Malicious installation or imported runtime code executes under the privileges of the user or Agent performing the installation. 5. That code may access data and resources available to the installation environment. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the privileges of the installing or invoking Agent. The accessible scope could include the Agent workspace, environment variables, user-readable files, and network access. This declaration does not itself grant ad ...[truncated 106 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `requests` to a reviewed version rather than allowing unrestricted resolution, for example: ```yaml metadata: { "openclaw": { "emoji": "🌤️", "requires": { "bins": ["python"], "pip": ["requests==2.32.5"] } } } ``` 2. Use a lock file or hash-verified requirements file, such as: ```text requests==2.32.5 --hash=sha256:<verified-package-hash> ``` 3. Pin and verify transitive dependencies where the installation system supports it. 4. Configure installation to use a trusted package index over HTTPS and disable untrusted supplemental indexes. 5. Periodically review and deliberately update pinned versions after checking security advisories and package integrity. 6. Install dependencies in an isolated virtual environment with only the filesystem and network permissions required for weather retrieval.