T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Third-Party Go Dependency Installed from a Mutable Source## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 13 **Vulnerability Type**: Supply-chain risk caused by an unpinned executable dependency **Risk Level**: Medium **Vulnerable code snippets:** ```yaml metadata: {"clawdbot":{"emoji":"📰","requires":{"bins":["blogwatcher"]},"install":[{"id":"go","kind":"go","module":"github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest","bins":["blogwatcher"],"label":"Install blogwatcher (go)"}]}} ``` ```shell go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest ``` ### Technical Analysis The installation metadata and documentation instruct the user or agent to install `github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest`. The `@latest` selector is mutable: it resolves the dependency version at installation time rather than identifying the exact version that was reviewed. The Go toolchain retrieves the selected source code, compiles it, and installs an executable. Consequently, the behavior installed in the future can differ from the behavior available when this Skill was audited. The project provides no immutable version or commit pin, expected checksum, signature, or provenance verification for the executable dependency. This is a supply-chain weakness rather than evidence that the current upstream project is malicious. The local package contains no executable scripts, and no malicious behavior was identified in the two reviewed files. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or a future release selected by `@latest`. 2. The attacker introduces malicious behavior into the upstream `blogwatcher` command. 3. A user or agent follows the Skill's installation metadata or documented command. 4. The Go toolchain retrieves and compiles the attacker-controlled latest source. 5. The resulting executable is installed and subsequently invoked as the trusted `blogwatcher` command. 6. The malicious executable oper ...[truncated 763 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a reviewed, immutable semantic version in both the installation metadata and documentation, for example: ```shell go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@vX.Y.Z ``` 2. Keep the version in line 5 synchronized with the command documented on line 13. 3. Review upstream source and release provenance before updating the pinned version. 4. Use Go module checksum verification and retain expected dependency information in a controlled build process. 5. Where available, verify signed releases, attestations, or reproducible build output before distributing or invoking the binary. 6. Run the installed tool with least privilege and restrict access to unnecessary credentials and sensitive files. 7. Adopt an explicit dependency-update process so upgrades are reviewed and tested rather than selected dynamically during installation.