T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:378
- Finding
- Unpinned Third-Party Package Is Installed and Executed Before Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:378-390` **Additional Locations**: `SKILL.md:212,228`; `analyze/SKILL.md:66`; `compliance/SKILL.md:113`; `discover/SKILL.md:108`; `enforce/SKILL.md:63`; `monitor/SKILL.md:61`; `registry/SKILL.md:67`; `runtime/SKILL.md:60`; `scan/SKILL.md:128,144,202`; `scan-infra/SKILL.md:111`; `troubleshoot/SKILL.md:59` **Vulnerability Type**: Unpinned and externally supplied executable dependency **Risk Level**: Medium ### Vulnerable Code The root Skill installs the package without a version or integrity constraint and verifies it only afterward: ```bash # Step 1: Install pip install agent-bom # Step 2: Review redaction logic BEFORE scanning # sanitize_env_vars() replaces ALL env var values with ***REDACTED*** # BEFORE any config data is processed or stored: # https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/security.py#L159 # Step 3: Review config parsing — only structural data extracted: # https://github.com/msaad00/agent-bom/blob/main/src/agent_bom/discovery/__init__.py # Step 4: Verify package provenance (Sigstore) agent-bom verify agent-bom ``` The Skill also recommends unpinned installation elsewhere: ```bash pipx install agent-bom ``` It additionally supports executing the unpinned package through `uvx`: ```json { "mcpServers": { "agent-bom": { "command": "uvx", "args": ["agent-bom", "mcp", "server"] } } } ``` ### Technical Analysis The reviewed artifact contains only Skill documentation and does not include the Python implementation that performs scanning, redaction, configuration parsing, network communication, or cloud access. Instead, all operational behavior is delegated to the externally distributed `agent-bom` package. Although the metadata declares version `0.76.4`, the installation commands do not specify `agent-bom==0.76.4`, a cryptographic hash, or a locked dependency set. The `uvx` command is similarly unpinned. Package verification is performe ...[truncated 2745 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every installation and execution instruction to the reviewed release: ```bash pipx install "agent-bom==0.76.4" pip install "agent-bom==0.76.4" uvx --from "agent-bom==0.76.4" agent-bom mcp server ``` 2. Verify the distribution before installing or importing it. Download the wheel without executing package code, validate a publisher signature or Sigstore attestation using an independent trusted verifier, and compare its SHA-256 digest against a digest recorded in the Skill. 3. Require hashes and locked transitive dependencies. Where supported, use a generated lock file and hash-enforced installation such as `pip install --require-hashes -r requirements.txt`. 4. Do not use the newly installed package to establish its own trust. Separate artifact verification from package execution and ensure the verifier is independently installed and pinned. 5. Include the reviewed implementation in the audit artifact or link the Skill to an immutable source commit and reproducible build provenance. Mutable `main` branch links should not be the security basis for redaction claims. 6. Run the scanner with least privilege: use an isolated environment, restrict filesystem access to explicitly approved paths, expose cloud credentials only for a confirmed cloud scan, and avoid providing unrelated secrets to the process. 7. Add automated checks that reject unpinned `pip`, `pipx`, and `uvx` examples whenever metadata declares a specific release. ]]>