T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Third-Party Dependency Installed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:5` and `SKILL.md:18-22`; dependency usage at `arxiv_search.py:10-16` **Vulnerability Type**: Insecure third-party dependency management **Risk Level**: Medium The skill declares and instructs users to install the `arxiv` package without an exact version, cryptographic hashes, a lockfile, or a verified package source. ```yaml metadata: {"openclaw": {"emoji": "📚", "requires": {"bins": ["python"], "pip": ["arxiv"]}, "homepage": "https://arxiv.org"}} ``` ```powershell # Install Python dependency pip install arxiv ``` The installed dependency is imported and used directly by the skill: ```python # Try to import arxiv try: import arxiv from arxiv import Client, Search except ImportError as e: print(f"Error: arxiv module not installed or import failed: {e}") print("Run: pip install arxiv") sys.exit(1) ``` ### Technical Analysis An unconstrained `pip install arxiv` resolves whichever package version the configured Python package index currently serves. The project does not provide an exact reviewed version, dependency lockfile, expected artifact hashes, or index restrictions. Consequently, the effective dependency code can change after this skill has been audited. Python packages may execute installation or build logic during installation, and their imported modules execute with the privileges of the Python process. If the upstream package, one of its transitive dependencies, the configured package index, or dependency resolution process is compromised, attacker-controlled code could be installed and subsequently executed. No evidence shows that the current `arxiv` dependency is malicious. The risk arises from the mutable and unverified supply-chain trust model. ### Attack Path 1. An attacker compromises the upstream package, a transitive dependency, or a package source used by the environment. 2. The attacker publishes a malici ...[truncated 925 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `arxiv` to a specifically reviewed version rather than accepting any available release. 2. Place direct and transitive dependencies in a locked requirements file. 3. Record cryptographic hashes for every permitted distribution and install with `pip install --require-hashes -r requirements.txt`. 4. Prefer prebuilt, reviewed wheels and disable unnecessary source builds where operationally feasible. 5. Restrict installation to a trusted package index and explicitly configure the approved index URL. 6. Perform dependency vulnerability and provenance checks when updating the lockfile. 7. Install and run the skill in an isolated virtual environment under a non-privileged account. 8. Replace the documentation command with a reproducible command referencing the hash-locked requirements file.