T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unpinned Third-Party Python Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"requires":{"bins":["curl","python3"]},"install":[{"id":"python","kind":"pip","package":"requests","bins":[],"label":"Install requests (pip)"}]}} ``` ### Technical Analysis The skill declares `requests` as a pip dependency without pinning it to a reviewed version or verifying its package hash. Consequently, installation resolves whichever version the configured Python package index considers current at installation time. The package name is legitimate and the audited file contains no evidence that it currently resolves to malicious software. Nevertheless, the unconstrained dependency creates a supply-chain risk because the installed code can change after the skill has been reviewed. Exploitation would require compromise of the package, its distribution account, the configured package index, or the dependency-resolution path. ### Attack Path 1. An attacker compromises the upstream dependency release process, package-index account, configured package mirror, or dependency-delivery path. 2. The attacker publishes or substitutes a malicious version of `requests`. 3. A user installs the skill in an environment where `requests` is absent or must be installed. 4. The unpinned declaration resolves and installs the attacker-controlled release. 5. Malicious package code executes during installation or when the skill imports and uses the package. ### Impact Assessment Successful exploitation could execute code with the privileges of the user or service running the package installation or OpenClaw process. Depending on those privileges and the surrounding environment, the attacker could access files, environment variables, network resources, and credentials available to that process. The issue does not itself provide privilege escalation, persistence, or credential ac ...[truncated 154 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `requests` to a specifically reviewed version rather than allowing unconstrained resolution, for example: ```yaml "package": "requests==<reviewed-version>" ``` 2. Where supported by the skill installation system, verify the dependency using an approved lock file and cryptographic hashes, such as pip's `--require-hashes` mode. 3. Install packages only from a trusted, authenticated package index or controlled internal mirror. 4. Incorporate dependency vulnerability and integrity scanning into the release process. 5. Regularly review and deliberately update the pinned version so security patches are adopted without silently accepting unreviewed releases. 6. If the runtime already provides a trusted HTTP client, remove the automatic pip installation and use the existing reviewed component instead. ]]>