T08 · Insecure Dependencies
Error
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party Code Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 16–21 and 39–55 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: High ### Vulnerable Code ```markdown ### 1) Install Lore locally - Clone or update the repo. - Install dependencies: ```bash pip install -e . python3 -m playwright install chromium ``` ``` ```markdown ### 4) MCP setup Use the repo’s `.mcp.json` (preferred) or add an equivalent MCP server entry: ```json { "mcpServers": { "lore": { "command": "uvx", "args": ["--from", "notebooklm-skill", "notebooklm-mcp"], "env": { "NOTEBOOKLM_DEFAULT_LANGUAGE": "en", "NOTEBOOKLM_DEFAULT_FORMAT": "json", "NOTEBOOKLM_POWERED_MODE": "1" } } } } ``` ``` ### Technical Analysis The skill directs an agent to clone or update a mutable Git repository and install it using `pip install -e .` without requiring a reviewed commit, immutable tag, lockfile, or verified integrity hash. Updating the repository can therefore change the code that is subsequently installed and executed after this skill has been reviewed. The MCP configuration also invokes `uvx` with the unpinned package name `notebooklm-skill`. Package resolution can retrieve and execute whichever compatible release is current at invocation time. The configuration does not enforce an exact version, distribution hash, trusted artifact provenance, or local review. Although retrieving dependencies is consistent with the skill's declared installation purpose, the lack of immutable dependency controls creates a supply-chain execution boundary. A compromised upstream repository, maintainer account, package registry account, or newly published malicious release could introduce code that executes with the privileges of the user or agent running the installation and MCP server. ### Attack Path 1. An attacker compromises the referenced ...[truncated 1710 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the Lore Git dependency to a reviewed, immutable commit SHA rather than instructing agents to update and execute the current branch. 2. Pin `notebooklm-skill` to an exact reviewed version in the `uvx` arguments, for example by using an explicit package version supported by the tool. 3. Verify downloaded distributions with approved cryptographic hashes and maintain a reviewed lockfile or constraints file for transitive Python dependencies. 4. Separate dependency updates from routine execution. Require review and security testing before changing the pinned commit, package version, or lockfile. 5. Obtain dependencies only from explicitly trusted repositories and registries. Enable available provenance or signature verification controls. 6. Run installation and the MCP server in an isolated virtual environment or sandbox with least-privilege filesystem and network access. 7. Deny the MCP process access to `~/.notebooklm/`, browser profiles, unrelated private source materials, and unnecessary environment variables unless access is essential to the requested operation. 8. Document the expected repository URL, commit identifier, package version, hashes, and verification procedure directly in the skill so an agent cannot silently resolve mutable upstream content.