T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:513
- Finding
- Mutable Gradle Plugin Dependency from External Repositories## Vulnerability Details **File Location**: `SKILL.md:168-178`, `SKILL.md:513-552` **Vulnerability Type**: Supply-chain risk caused by an unpinned Gradle plugin and external repositories **Risk Level**: Medium **Vulnerable Code**: ```groovy pluginManagement { repositories { gradlePluginPortal() google() mavenCentral() maven { url "https://mvn.mob.com/android" } } } dependencyResolutionManagement { repositoriesMode.set(RepositoriesMode.PREFER_SETTINGS) repositories { gradlePluginPortal() google() mavenCentral() maven { url "https://mvn.mob.com/android" } } } ``` ```groovy buildscript { dependencies { classpath "com.mob.sdk:MobSDK2:+" } } ``` For older Android Gradle Plugin versions, the Skill also recommends: ```groovy allprojects { repositories { maven { url "https://mvn.zztfly.com/android" } } } buildscript { repositories { maven { url "https://mvn.zztfly.com/android" } } dependencies { classpath "com.mob.sdk:MobSDK2:+" } } ``` ### Technical Analysis The dynamic version selector `MobSDK2:+` instructs Gradle to resolve the latest matching release at build time. Consequently, the effective plugin artifact can change after this Skill has been reviewed, even when neither the Skill nor the target project has changed. This is particularly sensitive because Gradle plugins execute code during project configuration and build operations. A malicious or compromised release can therefore execute with the permissions of the developer or CI account running Gradle. The legacy configuration also introduces `mvn.zztfly.com`, a repository outside the primary vendor domain used elsewhere in the Skill, increasing the number of supply-chain trust points. The Skill subsequently recommends running `./gradlew --refresh-dependencie ...[truncated 1481 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `com.mob.sdk:MobSDK2:+` with a specific, reviewed version. 2. Establish a controlled upgrade process in which new versions are reviewed and tested before changing the pin. 3. Use the official vendor repository only. Remove `mvn.zztfly.com` unless its ownership, necessity, and artifact integrity have been independently verified. 4. Enable Gradle dependency verification and commit trusted checksums or signatures in `gradle/verification-metadata.xml`. 5. Apply repository content filters so the vendor repository can resolve only the expected MobSDK group. 6. Prefer centralized repository declarations and fail builds when project-level repositories introduce unauthorized sources. 7. Avoid `--refresh-dependencies` as a routine integration step; use it only when a dependency refresh is explicitly needed. 8. Run Android builds in isolated, least-privileged CI environments without unnecessary access to unrelated credentials or signing material.