T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:36
- Finding
- Unpinned Third-Party Package and Source Installation## Vulnerability Details **File Location**: `SKILL.md:36-45`; `skill.json:25-31` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium The skill directs users to install packages and optional dependency groups from PyPI without version constraints or integrity hashes. It also provides a source installation workflow that clones the mutable default branch of an external repository without pinning a reviewed commit. ### Vulnerable Code `SKILL.md:36-45`: ```bash # From PyPI pip install swarm-safety # With LLM agent support pip install swarm-safety[llm] # Full development (all extras) git clone https://github.com/swarm-ai-safety/swarm.git cd swarm pip install -e ".[dev,runtime]" ``` `skill.json:25-31`: ```json "install": { "pip": "pip install swarm-safety", "source": "pip install -e \".[dev,runtime]\"", "with_api": "pip install swarm-safety[api]", "with_llm": "pip install swarm-safety[llm]", "with_all": "pip install swarm-safety[all]" } ``` ### Technical Analysis These installation commands resolve mutable external artifacts at installation time. No exact package version, transitive dependency lockfile, cryptographic hash, signed release requirement, or Git commit identifier is specified. Python package installation may execute package build hooks, and installed code will subsequently execute when imported or invoked. Optional dependency groups such as `llm`, `api`, `runtime`, and `all` broaden the dependency graph and therefore increase supply-chain exposure. Similarly, cloning the repository without a tag or commit allows its effective contents to change after this skill has been reviewed. The audited artifact does not itself establish that the referenced package or repository is malicious. The confirmed issue is that the documented installation process does not provide reproducibility or integrity guarantees. ### Attack Path 1. An attacker ...[truncated 1296 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `swarm-safety` to an explicitly reviewed version rather than resolving the latest available release. 2. Generate and publish a lockfile containing exact versions of all transitive dependencies for every supported optional dependency group. 3. Record cryptographic hashes for distribution artifacts and install with hash verification, such as `pip install --require-hashes -r requirements.lock`. 4. Pin source-based installation instructions to a reviewed Git commit SHA or cryptographically signed release tag. 5. Verify release signatures or attestations where available and document the expected upstream identity. 6. Install inside a dedicated virtual environment or container under a non-privileged account. Do not recommend system-wide or administrator-level installation. 7. Separate optional dependency groups and advise users to install only those strictly required for their task. 8. Add automated dependency scanning, provenance verification, and periodic review of pinned artifacts before updating documented versions.