T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Remote Repository Is Built and Executed During Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 27–29 **Vulnerability Type**: Unpinned and unaudited remote dependency **Risk Level**: Medium ```yaml install: - run: "git clone https://github.com/claw4business/quickbooks-online-cli.git ~/skills/qb-cli" - run: "cp ~/skills/qb-cli/.env.example ~/skills/qb-cli/.env" - run: "docker compose -f ~/skills/qb-cli/docker-compose.yml build" ``` ### Technical Analysis The installation process clones the mutable default branch of an external Git repository without specifying a reviewed commit hash, immutable release tag, signature, or checksum. It then immediately builds the repository's Docker Compose configuration. Consequently, the effective code executed by the Skill can change after this Skill package has been reviewed. The external repository's source code, Dockerfile, Compose configuration, build dependencies, and runtime behavior are not included in the audited artifact and therefore cannot be verified by this audit. This behavior creates a supply-chain trust boundary. If the upstream repository, a maintainer account, or one of its build dependencies is compromised, malicious commands can be introduced without modifying `SKILL.md`. The adjacent `.env` operation only copies `.env.example` to `.env` inside the declared Skill directory. It does not, by itself, read or exfiltrate an existing secret. Creating a configuration file is necessary for the declared QuickBooks integration, but the file will subsequently hold sensitive Intuit credentials and must be protected from the remotely sourced implementation. ### Attack Path 1. An attacker compromises the referenced repository, its default branch, a maintainer account, or an upstream build dependency. 2. The attacker modifies the Dockerfile, Compose file, application source, or dependency configuration to execute malicious logic. 3. A user installs the Skill after the malicious change. 4. The unrestricted ` ...[truncated 1636 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the repository checkout to a reviewed full commit SHA rather than cloning and building the mutable default branch. 2. Prefer an immutable, signed release artifact and verify its cryptographic checksum before extraction or execution. 3. Verify Git commit or release signatures against explicitly trusted maintainer keys. 4. Include the reviewed Dockerfile, Compose file, dependency lockfiles, and relevant source code in the Skill package when practical. 5. Pin container base images by digest and lock application dependencies to exact versions with integrity hashes. 6. Review the Compose configuration for privileged mode, host networking, Docker socket mounts, broad host-volume mounts, and unnecessary Linux capabilities. 7. Run the container as a non-root user with a read-only root filesystem and only the minimum required workspace mount. 8. Provide QuickBooks credentials only at runtime. Do not bake `.env` into an image or include it in the Docker build context. 9. Create `.env` with restrictive permissions, such as mode `0600`, and ensure it is excluded from source control, logs, exports, and backups where appropriate. 10. Scope the Intuit application and connected QuickBooks account to the minimum permissions necessary, and rotate credentials and revoke OAuth tokens if upstream compromise is suspected. 11. Require explicit review and approval before updating the pinned revision.