T08 · Insecure Dependencies
Warning
- Location
- pyproject.toml:18
- Finding
- Unbounded Third-Party Dependencies and Unverified Package Execution<![CDATA[ ## Vulnerability Details **File Location**: `pyproject.toml:18-21` **Related Locations**: `README.md:18-23`, `SKILL.md:139-144` **Vulnerability Type**: Supply-chain exposure through open-ended dependency resolution **Risk Level**: Medium ### Complete Code Snippet ```toml dependencies = [ "mcp>=1.0", "cervellaswarm-lingua-universale>=0.3.3", ] ``` The documented installation instructions execute packages resolved from an external package registry: ```bash # Run as MCP server (uvx, no install needed) uvx openclaw-skill-lingua-universale # Or install and run pip install openclaw-skill-lingua-universale lu-mcp ``` ```bash # As a Claude Code MCP server uvx openclaw-skill-lingua-universale # Or install directly pip install openclaw-skill-lingua-universale lu-mcp # starts stdio MCP server ``` ### Technical Analysis Both runtime dependencies are specified with minimum versions and no upper bounds. The audited project also contains no dependency lockfile or package hashes. Consequently, `pip` or `uvx` may install future versions that were not included in this audit. Python modules can execute code during import, and this server imports both `mcp.server.fastmcp` and `cervellaswarm_lingua_universale` during normal operation. A compromised or malicious future release satisfying these broad version constraints could therefore execute code under the identity of the user running the MCP server. The reviewed source does not itself download or execute a remote payload at runtime, and no currently malicious dependency was established. The issue is the lack of reproducible and integrity-verified dependency resolution, which increases supply-chain risk. ### Attack Path 1. An attacker compromises the publishing account or release infrastructure of an accepted dependency, or otherwise causes a malicious version to be served by the configured package index. 2. The malicious release uses a version satisfying `mcp>=1.0` or `cervellaswarm-lingua-univers ...[truncated 1125 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin reviewed runtime dependencies to exact versions rather than open-ended minimum versions, for example: ```toml dependencies = [ "mcp==<reviewed-version>", "cervellaswarm-lingua-universale==<reviewed-version>", ] ``` 2. Generate and publish a lockfile containing all transitive dependencies so deployments resolve a reproducible dependency graph. 3. Use hash verification for deployment artifacts, such as a requirements file generated with hashes and installed using: ```bash pip install --require-hashes -r requirements.lock ``` 4. Configure installation workflows to use an explicitly trusted package index and prevent unintended fallback to untrusted indexes. 5. Add automated dependency scanning, provenance verification, and release review before updating pinned versions. 6. Consider publishing signed artifacts and documenting signature or checksum verification for users running the package through `uvx`. 7. Run the MCP server in a least-privilege environment with restricted filesystem, credential, and network access to limit the impact of a future dependency compromise. ]]>