T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:45
- Finding
- Unpinned Python Dependencies and Mutable Runtime Tokenizer Retrieval## Vulnerability Details **File Location**: `SKILL.md:45-48`, `SKILL.md:306-310`, `scripts/token-estimator.py:15-30`, and `scripts/token-estimator.py:48-53` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and mutable external artifacts **Risk Level**: Medium ### Vulnerable Code `SKILL.md:45-48`: ```bash # ClAWHub installation clawhub install token-estimator # Install dependencies pip3 install tiktoken transformers dashscope ``` `SKILL.md:306-310`: ```python # requirements.txt tiktoken>=0.5.0 # OpenAI/Gemini tokenizer transformers>=4.30.0 # Qwen tokenizer dashscope>=1.14.0 # Bailian API model information ``` `scripts/token-estimator.py:15-30`: ```python # Attempt to import tokenizer libraries try: import tiktoken TIKTOKEN_AVAILABLE = True except ImportError: TIKTOKEN_AVAILABLE = False try: from transformers import AutoTokenizer TRANSFORMERS_AVAILABLE = True except ImportError: TRANSFORMERS_AVAILABLE = False try: import dashscope DASHSCOPE_AVAILABLE = True except ImportError: DASHSCOPE_AVAILABLE = False ``` `scripts/token-estimator.py:48-53`: ```python if TRANSFORMERS_AVAILABLE: try: print(f"🔧 Using Qwen Tokenizer (transformers)", file=sys.stderr) return AutoTokenizer.from_pretrained("Qwen/Qwen-7B") except Exception as e: print(f"⚠️ Qwen Tokenizer loading failed: {e}", file=sys.stderr) ``` ### Technical Analysis The documented installation command resolves the current available releases of `tiktoken`, `transformers`, and `dashscope` without exact version or artifact-hash verification. The example dependency declarations only specify minimum versions, which also permit future, unaudited releases. These packages are imported when the script starts. Python packages can execute module initialization code during import, so a compromised ups ...[truncated 2336 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every Python dependency to an exact reviewed version in a requirements or lock file. 2. Require package hashes, for example by generating a hash-locked requirements file and installing with `pip --require-hashes`. 3. Remove the unused `dashscope` dependency and import unless they become necessary for implemented functionality. 4. Pin the Hugging Face tokenizer to a reviewed immutable commit: ```python AutoTokenizer.from_pretrained( "Qwen/Qwen-7B", revision="REVIEWED_COMMIT_SHA", trust_remote_code=False, ) ``` 5. Pre-download and verify tokenizer artifacts during a controlled build process. Use local-only loading in production where practical. 6. Document that the first tokenizer load may access an external service; provide an explicitly offline fallback. 7. Run the Skill in a restricted environment with minimal filesystem permissions, filtered environment variables, resource limits, and constrained outbound network access. 8. Use automated dependency vulnerability scanning and review lockfile updates before release.