T08 · Insecure Dependencies
Warning
- Location
- references/setup.md:34
- Finding
- Unpinned and Unverified Third-Party CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-18`; `references/setup.md:34-52` **Vulnerability Type**: Unpinned third-party dependency and unverified executable installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:15-18`: ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:34-52`: ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ```markdown ### Other platforms Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH. ``` ### Technical Analysis The installation metadata and setup guide direct users to install a third-party command-line utility without pinning a reviewed version, commit, package digest, or binary checksum. The Go command explicitly selects `@latest`, while npm installation without a version also resolves a mutable current release. Package-manager formulas and the latest GitHub release are similarly mutable. Because the resulting `yutu` executable handles Google OAuth credentials and cached YouTube access tokens, its supply-chain integrity is security-sensitive. If the upstream package, repository, release account, package-manager formula, or publishing credentials are compromised, a malicious update could be distributed through the documented installation procedure. No evidence establishes that the current upstream package is malicious. The vulnerability is the absence of reproducible version selection and artifact verification, which prevents users from ensuring that the installed executable is the same artifact that was reviewed. ### Attack Path 1. An attacker compromises an upstream package registry account, source repository, release account, build pipeline, or package-manager distribution channel. 2. The attacker p ...[truncated 1507 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the npm package to a specifically reviewed version, for example: ```bash npm install -g @eat-pray-ai/yutu@<reviewed-version> ``` 2. Replace `@latest` in the Go installation command with a reviewed semantic version or immutable commit: ```bash go install github.com/eat-pray-ai/yutu@<reviewed-version-or-commit> ``` 3. Pin the version in `SKILL.md` installation metadata if the Skill schema supports version constraints or immutable package references. 4. Publish SHA-256 checksums and, preferably, cryptographic signatures for release binaries. Require users to verify both before placing a binary in `PATH`. 5. Document the expected package owner, repository, release version, checksum, and signature-verification procedure so users can detect package substitution. 6. Use lockfiles, package-manager lock mechanisms, or an internally mirrored and reviewed artifact where supported. 7. Avoid global installation where practical. Run the dependency in a constrained environment with access only to the files and network destinations required for YouTube API operations. 8. Request only the minimum necessary Google OAuth scopes and protect cached tokens with restrictive filesystem permissions. Do not expose credential or token contents in debug logs. 9. Establish a dependency-update review process that verifies source changes, build provenance, package signatures, and published artifact hashes before updating the pinned version. ]]>