T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned and Unaudited Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, line 3 and lines 16–20 **Vulnerability Type**: Supply-chain risk from an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code At line 3: ```text Install with `pip install webserp`. No API keys needed. ``` At lines 16–20: ```markdown ## Install ```bash pip install webserp ``` ``` ### Technical Analysis The documented installation command resolves the current `webserp` release and its transitive dependencies from the configured Python package index without an exact version constraint or integrity hash. The project provides no lockfile, package hash, canonical source repository, publisher verification, or local implementation that would allow the installed code to be reviewed against the behavior claimed in `SKILL.md`. Python package installation may execute package build or installation logic, while subsequent invocation of the installed CLI executes its runtime code. Consequently, a compromised publisher account, malicious replacement release, dependency compromise, or unexpected future package change could introduce code that was not present during this audit. The audit does not establish that the current package is malicious. The vulnerability is that the instructions trust mutable, unaudited third-party code without version or integrity controls. ### Attack Path 1. An agent or user follows the installation instructions in `SKILL.md`. 2. The command `pip install webserp` asks the configured package index to resolve the latest eligible release and its transitive dependencies. 3. An attacker compromises the package, one of its dependencies, its publisher account, or the relevant distribution channel and publishes a malicious or altered release. 4. Because no version and hashes are pinned, the installer may retrieve the attacker-controlled release. 5. Malicious code can execute during package building or installation, or when ...[truncated 1088 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `webserp` to an exact, reviewed version rather than allowing installation of the latest release. 2. Use a hash-locked dependency file, such as a requirements file containing `--hash` entries generated from verified artifacts. 3. Lock and review all transitive dependencies, not only the direct package. 4. Document the canonical source repository, expected publisher identity, release provenance, and verified package hashes. 5. Prefer reproducible, signed releases and verify package signatures or attestations where available. 6. Review the package source and installation metadata before approving it for agent execution. 7. Install and run the tool in an isolated, least-privilege environment without unnecessary credentials, sensitive environment variables, or access to host files. 8. Avoid privileged or system-wide installation. Use a dedicated virtual environment or disposable container. 9. Document that search queries are transmitted to third-party services and prohibit placing secrets, credentials, personal data, or other sensitive material in queries.