T08 · Insecure Dependencies
Warning
- Location
README_OpenClaw.md:27- Finding
Unpinned Third-Party Python Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
README_OpenClaw.md, lines 27-34
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: MediumVulnerable Code
markdown ## 필수 요구사항 - **python3** (스크립트 실행에 필요) - 선택: `openpyxl` (Excel 생성), `python-docx` (Word 생성), `reportlab` (PDF 생성) ```bash pip install openpyxl python-docx reportlabtext ### Technical Analysis The installation command retrieves three third-party packages without specifying reviewed versions, cryptographic hashes, a lockfile, or an isolated Python environment. Dependency resolution therefore relies on the mutable state of the configured package index at installation time. Although the documented package names are established projects and no malicious package is directly identified, the installation procedure does not ensure that users receive the same audited artifacts. A compromised package release, compromised package-index account, unsafe transitive dependency, or maliciously configured package source could result in unintended code being installed. Python packages may execute build-system or installation-related code, and subsequently execute package code when imported. ### Attack Path 1. An attacker compromises a named dependency, one of its transitive dependencies, its publishing account, or a package source configured in the victim's environment. 2. The attacker publishes a malicious release that remains compatible with unconstrained dependency resolution. 3. A user follows the documentation and runs: ```bash pip install openpyxl python-docx reportlab ``` 4. `pip` resolves and downloads the attacker-controlled or compromised release because no version or artifact hash is enforced. 5. Malicious code may run during package building or installation, or later when the Skill imports and uses the installed package. ### Impact Assessment Successful exploitation could execute code with the pr ...[truncated 566 chars]- Remediation
View remediation
Remediation Suggestions
- Define reviewed, exact dependency versions in a requirements file:
text openpyxl==<reviewed-version> python-docx==<reviewed-version> reportlab==<reviewed-version> - Generate and verify SHA-256 hashes for every direct and transitive dependency, then require them during installation:
bash python3 -m pip install --require-hashes -r requirements.txt - Commit the reviewed requirements or lock file to the Skill package so installations are reproducible.
- Recommend installation in a dedicated virtual environment rather than the global Python environment:
bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt - Document the expected package index and advise users not to install from untrusted mirrors or additional indexes.
- Periodically audit pinned dependencies for known vulnerabilities and update versions and hashes through a controlled review process.
- Avoid running dependency installation as root or with administrator privileges.
- Define reviewed, exact dependency versions in a requirements file: