T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"📱","requires":{"bins":["wacli"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/wacli","bins":["wacli"],"label":"Install wacli (brew)"},{"id":"go","kind":"go","module":"github.com/steipete/wacli/cmd/wacli@latest","bins":["wacli"],"label":"Install wacli (go)"}]}} ``` ### Technical Analysis The Go installation source uses the mutable version selector `@latest`, and the Homebrew installation references a third-party tap without specifying a reviewed version or integrity verification mechanism. Consequently, the dependency installed in the future may differ from the version that was reviewed during this audit. This creates a supply-chain risk: compromise of the upstream repository, package publication process, maintainer account, release artifact, or Homebrew tap could cause users to install altered software without any corresponding change to this Skill. No evidence establishes that the current upstream package is malicious; the vulnerability is the absence of version pinning and artifact verification. ### Attack Path 1. An attacker compromises an upstream maintainer account, repository, release process, Go module source, or Homebrew tap. 2. The attacker publishes a malicious release or changes the installation metadata or source selected by `@latest`. 3. A user installs `wacli` through one of the installation methods declared by the Skill. 4. The unverified dependency is installed and subsequently executed with the user's operating-system privileges. 5. When the user authenticates or invokes the CLI, the compromised program may access available WhatsApp authentication state, synchronized history, recipient information, and files supplied for transmission. ### Impact Assessment A compromised dependency ...[truncated 613 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `github.com/steipete/wacli/cmd/wacli@latest` with a specific, reviewed semantic version or immutable commit digest. 2. Pin the Homebrew installation to a reviewed release where supported, or provide an installation method using a versioned release artifact. 3. Publish expected SHA-256 checksums for downloaded artifacts and verify them before installation. 4. Prefer cryptographically signed releases and document signature verification using a trusted maintainer key. 5. Use automated dependency monitoring to identify newly disclosed vulnerabilities, but require review before updating the pinned version. 6. Document the exact upstream repository and trusted release channel so users can detect dependency-confusion or repository-substitution attempts. 7. Run the CLI with least privilege and restrict access to `~/.wacli`, because that directory may contain sensitive account and synchronized-history data.