T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:50
- Finding
- Unpinned Installation from a Mutable Git Repository## Vulnerability Details **File Location**: `SKILL.md:50-53` **Vulnerability Type**: Unpinned remote source dependency **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Install ```bash pip install git+https://github.com/minirr890112-byte/HermesMade.git#subdirectory=task-cost-estimator ``` ``` The same installation instruction also appears in `README.md:5-9`. ### Technical Analysis The documented installation command retrieves the package from the current state of a third-party Git repository without pinning a reviewed commit hash, release tag, package version, or artifact checksum. Consequently, the code installed later may differ from the code reviewed during this audit. Installing a Python project is security-sensitive because `pip` invokes the selected build backend and processes package-controlled build metadata. If the referenced repository is compromised or later contains malicious build or runtime code, following this command could execute that changed code with the privileges of the user performing the installation. No malicious remote retrieval occurs in the audited CLI itself, and no malicious code was identified in the reviewed artifact. The risk arises specifically from the mutable supply-chain installation instruction. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or another mechanism controlling its default branch. 2. The attacker adds malicious package code, build configuration, or build-time behavior. 3. A user or AI Agent follows the installation command in `SKILL.md` or `README.md`. 4. `pip` downloads the repository's then-current content rather than the reviewed artifact. 5. The Python build/install process processes the attacker-controlled project. 6. Malicious behavior executes with the installing user's permissions during installation or when the installed command is invoked. ### Impact Assessment Successful expl ...[truncated 394 chars]
- Remediation
- ## Remediation Suggestions - Publish reviewed releases to a trusted package registry and require an exact package version. - Install with hash verification, such as a locked requirements file using `--require-hashes`. - If Git installation remains necessary, pin the URL to a reviewed full commit SHA rather than a branch or mutable tag. - Verify the pinned commit's provenance and signatures where available. - Generate and verify checksums or attestations for release artifacts. - Use an isolated virtual environment and avoid running installation commands with administrative privileges. - Keep the installation command in `SKILL.md` and `README.md` synchronized so both point to the same immutable, reviewed release.