T08 · Insecure Dependencies
Error
- Location
- SKILL.md:31
- Finding
- Mutable and Unreviewed PyPI Dependency Executes with User Privileges< PyPI package, **≥ 1.0.2** (MIT, stdlib-only, no transitive deps) — 1.0.1 introduced unconditional stdout secret-stripping; 1.0.2 adds `call --dry-run` for credential-free preview of a planned invocation The bundled `bin/uno.py` is a thin launcher that forwards to the `uno-cli` package. This means upgrades land via `pip install --upgrade uno-cli` without shipping a new skill release. CLI path (relative to this file): `bin/uno.py` ## Step 0: Install the Uno CLI (one-time) ```bash python3 -m pip install --user --upgrade 'uno-cli>=1.0.2' ``` ``` From `bin/uno.py`: ```python def _report_missing(): sys.stdout.write( json.dumps( { "error": "uno-cli not installed", "hint": ( "Install the Uno CLI first: " "python3 -m pip install --user --upgrade 'uno-cli>=1.0.0'" ), "install_url": "https://pypi.org/project/uno-cli/", }, ensure_ascii=False, ) + "\n" ) sys.exit(2) try: from uno_cli.cli import main except ModuleNotFoundError: _report_missing() # Attribution tag only — no scope restriction for the full-gateway skill. os.environ.setdefault("UNO_CALLER_SKILL", "uno-cli") ``` ### Technical Analysis The bundled script does not implement the advertised CLI functionality. It imports and executes `uno_cli.cli.main` from a separately installed PyPI package. Consequently, authentication, credential-file access, secret filtering, network communication, and remote tool invocation are all performed by code absent from the audited artifact. The installation command combines `--upgrade` ...[truncated 1940 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `uno-cli` to one specifically reviewed version instead of using a lower bound: ```bash python3 -m pip install --user 'uno-cli==REVIEWED_VERSION' ``` 2. Remove `--upgrade` from automated or agent-directed installation instructions. 3. Enforce package integrity using a reviewed wheel hash and `pip --require-hashes`. 4. Vendor the reviewed CLI implementation into the Skill, or include its complete source so credential and network behavior can be audited with the Skill. 5. Use a lock file or similarly reproducible dependency manifest. 6. Change every installation hint to the same reviewed version. In particular, do not permit version `1.0.0` when the declared protections require at least `1.0.2`. 7. Verify the installed package version before importing it and fail closed if it differs from the reviewed version. 8. Perform dependency provenance and release-signature verification where supported. ]]>