T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:53
- Finding
- Unpinned Remote Repository Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 53–58 **Vulnerability Type**: Unpinned third-party source installation **Risk Level**: Medium **Vulnerable Code**: ```bash # Clone and install git clone https://github.com/pearjelly/cliany.site.git cd cliany.site pip install -e . # Verify cliany-site --version cliany-site doctor --json ``` ### Technical Analysis The installation instructions clone the mutable default branch of a third-party Git repository and install it in editable mode without pinning an immutable commit, verifying a signature or checksum, or reviewing the downloaded source. Although the repository URL matches the Skill's declared homepage and is not an obviously deceptive source, `pip install -e .` can execute Python packaging and build hooks with the installing user's privileges. Because the executable implementation is not included in this Skill artifact, its installation behavior could not be audited. The effective code installed by these instructions can change after the Skill has been reviewed. A compromise of the upstream repository, maintainer account, release process, or dependency chain could therefore introduce arbitrary code into future installations. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or a dependency used by the project. 2. The attacker adds malicious packaging, build, or runtime code to the repository's default branch. 3. A user or autonomous agent follows the instructions in `SKILL.md`. 4. `git clone` retrieves the modified default branch without commit or release pinning. 5. `pip install -e .` invokes the package installation process and any applicable build hooks. 6. The malicious code executes with the privileges of the user performing the installation or later invoking the installed command. ### Impact Assessment Successful exploitation could provide arbitrary code executi ...[truncated 541 chars]
- Remediation
- ## Remediation Suggestions 1. Pin installation to a reviewed release tag and its immutable commit hash rather than the repository's default branch. 2. Verify the release through a trusted signature mechanism and publish a SHA-256 checksum obtained through an independent trusted channel. 3. Prefer a version-pinned package or immutable source archive with hash verification. 4. Use a dedicated virtual environment with a locked dependency set and hash-verified dependency installation. 5. Avoid editable installation for end users unless development behavior is specifically required. 6. Include the executable source and dependency lock files in the audited Skill artifact, or clearly identify them as unaudited external components. 7. Document that users should inspect packaging configuration and build hooks before installation. A hardened example would clone and check out a documented immutable commit, verify that commit or release signature, and only then install inside an isolated virtual environment.