T08 · Insecure Dependencies
Error
- Location
- SKILL.md:5
- Finding
- Unpinned Executable Dependency Installed from a Mutable Git Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` and `SKILL.md:30-33` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code At `SKILL.md:5`: ```yaml metadata: {"openclaw":{"emoji":"🖨️","requires":{"bins":["printer-ai"]},"install":[{"id":"uv","kind":"uv","package":"git+https://github.com/NullYing/printer-ai-skills.git","bins":["printer-ai"],"label":"Install printer-ai (uv)"}]}} ``` At `SKILL.md:30-33`: ```bash # Install uv tool install git+https://github.com/NullYing/printer-ai-skills.git ``` ### Technical Analysis The skill instructs users and agents to install executable Python package code directly from a GitHub repository without pinning an immutable release, tag, or full commit hash. No package hash, artifact signature, or provenance verification is required. Because the URL resolves to the repository's mutable default branch, the code downloaded during a future installation can differ from the version reviewed during this audit. A compromised maintainer account, repository ownership change, malicious upstream commit, or compromised dependency could therefore alter the effective installation payload without requiring any change to this skill file. The installation process may execute package build or installation hooks. The resulting `printer-ai` executable is also trusted to process local file paths and interact with the operating system's printer subsystem. This creates a supply-chain trust boundary that is not protected by immutable versioning or integrity verification. This finding establishes an unsafe dependency-delivery mechanism; it does not establish that the current upstream repository is malicious. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, or an upstream dependency used by the repository. 2. The attacker modifies the repository's default branch to include malicious installation hooks or runtime behavior. ...[truncated 1358 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin an immutable dependency revision** - Replace the mutable Git URL with a full, reviewed commit SHA. - Do not rely only on a branch or movable tag. Example: ```bash uv tool install "git+https://github.com/NullYing/printer-ai-skills.git@FULL_COMMIT_SHA" ``` 2. **Prefer a trusted package registry** - Publish the CLI as a versioned package. - Pin an exact audited version rather than allowing unconstrained upgrades. 3. **Verify package integrity** - Require cryptographic hashes for released artifacts and locked dependencies. - Verify signed commits, signed tags, or package provenance where supported. - Document the expected repository owner, commit SHA, and artifact digest. 4. **Lock transitive dependencies** - Generate and maintain a dependency lock file containing exact versions and hashes. - Review dependency changes before updating the pinned release. 5. **Harden the update process** - Use automated dependency and source-code scanning before approving a new revision. - Require code review and CI verification for updates to the pinned commit. - Avoid silently tracking the repository's default branch. 6. **Apply least privilege** - Install and run the CLI as an unprivileged user. - Do not grant administrator or root permissions unless strictly necessary. - Limit access to sensitive documents and printer-management interfaces where the operating system permits. ]]>