T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Package Is Installed and Executed as an MCP Server## Vulnerability Details **File Location**: `SKILL.md:10-14`; additional installation instructions at `SKILL.md:54-67` and `README.md:31-48` **Vulnerability Type**: Unpinned and unauditable executable dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:10-14`: ```yaml install: - kind: uv package: memorine bins: [memorine] entry: uv run python -m memorine.mcp_server ``` `SKILL.md:54-67`: ```bash pip install memorine ``` ```json { "mcpServers": { "memorine": { "command": "python3", "args": ["-m", "memorine.mcp_server"] } } } ``` `README.md:31-48`: ```bash pip install memorine ``` ```bash pip install memorine[embeddings] ``` ```bash pip install memorine[ui] ``` Everything? `pip install memorine[all]`. The base install stays at zero dependencies and works on its own. The extras are optional layers on top. ### Technical Analysis The Skill installs the third-party `memorine` package without an exact version, package hash, lockfile, or vendored source and then executes `memorine.mcp_server`. The audited artifact contains only documentation and configuration, so the actual code receiving MCP requests and accessing the persistent SQLite memory cannot be reviewed from this project. Because package resolution is not constrained, the code installed by the same instructions can change after the Skill has been audited. Installation of optional extras similarly leaves their transitive dependency versions unconstrained and broadens the supply-chain attack surface. A compromised publisher account, malicious future release, or dependency compromise could therefore cause attacker-controlled Python code to be installed and executed under the identity running the agent. This finding does not establish that the current `memorine` package is malicious. It establishes that the Skill trusts and executes mutable, unpinned thi ...[truncated 1658 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `memorine` to an exact, reviewed release in both the OpenClaw installation metadata and all command examples. 2. Require cryptographic hashes for downloaded distributions, such as through a hash-locked requirements file using `pip --require-hashes`. 3. Commit a lockfile that fixes all direct and transitive dependencies, including separate dependency sets for the `embeddings`, `ui`, and `all` extras. 4. Include or vendor the runtime source in the audited artifact so the MCP server, ownership validation, database access, and network behavior can be reviewed alongside the Skill. 5. Verify package publisher provenance and release signatures in CI, and run dependency vulnerability and integrity scanning before updates are accepted. 6. Prevent automatic installation of newer releases until they have passed source review and sandbox testing. 7. Run the MCP server under a dedicated least-privileged account or sandbox with access limited to its required database directory. Restrict network access unless it is explicitly required. 8. Document the exact package version and hashes whose behavior supports the security assertions made in `SKILL.md`.