T08 · Insecure Dependencies
Warning
- Location
- README.md:50
- Finding
- Unpinned Third-Party Dependencies Permit Unreviewed Package Execution## Vulnerability Details **File Location**: `README.md:50-56`, `README.md:291-297`, `SKILL.md:5963`, `scripts/requirements.txt:1-2`, and `examples/requirements.txt:1-2` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and a moving package release **Risk Level**: Medium ### Vulnerable Code `README.md:50-56` and `README.md:291-297`: ```bash pip install python-pptx lxml npx clawhub@latest install mck-ppt-design ``` `SKILL.md:5963`: ```bash pip install python-pptx lxml ``` `scripts/requirements.txt:1-2` and `examples/requirements.txt:1-2`: ```text python-pptx>=0.6.21 lxml>=4.9.0 ``` ### Technical Analysis The installation instructions execute `clawhub@latest`, which is a moving release rather than a reviewed, immutable version. The Python dependency files similarly use minimum-version constraints without upper bounds, exact pins, package hashes, or a lockfile. Consequently, the code installed in the future may differ from the code reviewed during this audit. If a package registry account, dependency maintainer, publication pipeline, or transitive dependency is compromised, a newly published malicious release could be selected automatically. Package-manager installation and lifecycle behavior may then execute attacker-controlled code with the privileges of the user running `npm`, `npx`, or `pip`. No evidence was found that the currently declared dependencies are malicious. The finding concerns the absence of controls that bind installation to reviewed artifacts. ### Attack Path 1. An attacker compromises a dependency maintainer, registry account, release pipeline, or relevant transitive dependency. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the documented `npx clawhub@latest install ...` command, or installs the Python requirements after the malicious version becomes eligible. 4. The package manager resolves and download ...[truncated 1030 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the moving npm release with a reviewed exact version: ```bash npx clawhub@<reviewed-version> install mck-ppt-design ``` 2. Pin Python dependencies to exact, tested versions rather than minimum-only ranges: ```text python-pptx==<reviewed-version> lxml==<reviewed-version> ``` 3. Generate a lockfile that records the complete transitive dependency graph. 4. Require cryptographic hashes for Python packages, for example through a hash-locked requirements file and: ```bash pip install --require-hashes -r requirements.txt ``` 5. Commit and enforce the npm lockfile where npm-based installation is part of the supported workflow, and use deterministic installation commands. 6. Configure trusted package registries explicitly and reject unexpected alternate indexes or registries. 7. Review dependency updates before changing pins, including release provenance, maintainer changes, package signatures where available, and transitive dependency differences. 8. Run dependency installation and presentation generation in a least-privileged, isolated environment without unnecessary credentials or access to sensitive host files. 9. Add automated dependency and supply-chain scanning to CI while retaining manual approval for version updates.