T08 · Insecure Dependencies
- Location
SKILL.md:168- Finding
Unpinned Executable Gradle Plugin Loaded from an Additional Repository
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 168–190; repeated at lines 210–230 and 625–665
Vulnerability Type: Supply-chain risk through an unpinned executable dependency
Risk Level: HighVulnerable Code
groovy maven { url "https://mvn.zztfly.com/android" }groovy buildscript { dependencies { // Add FlySDK plugin configuration classpath 'cn.fly.sdk:FlySDK:+' // Add Google Services plugin configuration for FCM classpath 'com.google.gms:google-services:4.3.14' } }The same unsafe dynamic FlySDK version is also recommended for older Gradle configurations:
groovy buildscript { dependencies { classpath 'cn.fly.sdk:FlySDK:+' } }Technical Analysis
The Skill directs the agent to add an external Maven repository and resolve the FlySDK Gradle plugin using the dynamic version selector
+. Unlike an ordinary library that may only become active at application runtime, a Gradle plugin executes code during build configuration and compilation.The
+selector allows the repository to determine which version will be downloaded during each build. Therefore, the effective executable dependency may change after this Skill has been reviewed. Builds are not reproducible, and users cannot reliably determine which plugin implementation will execute from the checked-in project configuration alone.HTTPS protects the transport connection but does not protect against a compromised repository, compromised publisher account, malicious future release, or accidental publication of a defective artifact.
Attack Path
- An attacker compromises the package publisher, repository infrastructure, or credentials authorized to publish
cn.fly.sdk:FlySDK. - The attacker publishes a newer artifact version containing malicious Gradle plugin logic.
- A user follows the Skill and configures `classpath 'c ...[truncated 1096 chars]
- An attacker compromises the package publisher, repository infrastructure, or credentials authorized to publish
- Remediation
View remediation
Remediation Suggestions
-
Replace the dynamic version with a specific, reviewed release:
groovy classpath 'cn.fly.sdk:FlySDK:REVIEWED_EXACT_VERSION' -
Verify the selected version against authoritative MobTech documentation before recommending it.
-
Enable Gradle dependency verification and commit trusted checksums or signatures in
gradle/verification-metadata.xml. -
Use Gradle dependency locking where supported to preserve reproducible resolution.
-
Apply repository content filtering so the additional repository can only provide the explicitly required group:
groovy maven { url "https://mvn.zztfly.com/android" content { includeGroup "cn.fly.sdk" } } -
Document the plugin's provenance, expected version, and verification procedure.
-
Require explicit user approval after displaying the exact repository, artifact version, and integrity information.
-
Periodically review and deliberately update the pinned version rather than accepting new releases automatically.
-