T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party CLI Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 14–18 **Vulnerability Type**: Unpinned executable dependency from a third-party Homebrew tap **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: brew formula: runapi-ai/tap/runapi bins: - runapi ``` ### Technical Analysis The skill instructs the environment to install the `runapi` executable from the third-party Homebrew tap `runapi-ai/tap`. It does not pin a reviewed version or immutable formula revision, nor does it specify a checksum or signature-verification requirement. Consequently, the executable installed at invocation time may differ from the one originally reviewed. If the tap, formula, package-hosting infrastructure, or publisher account is compromised, a modified CLI could execute locally under the invoking user's privileges. This risk is particularly relevant because the documented workflow uses the CLI for authentication, local-file uploads, request submission, and result retrieval. There is no evidence in the audited project that the current dependency is malicious. This finding concerns the mutable and insufficiently verified dependency-installation mechanism. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its publisher account, formula source, or referenced package artifact. 2. The attacker replaces a future `runapi` release or formula target with a malicious executable. 3. An agent follows the skill metadata and installs `runapi-ai/tap/runapi` without an immutable version or integrity check. 4. The installed executable runs during authentication, contract discovery, media upload, or task submission. 5. The executable accesses data available to the invoking process and may transmit it externally or perform other actions within that user's permissions. ### Impact Assessment Successful exploitation would provide code execution with the privileges of the user or agent that installs and invokes the CLI. Depending on the runtime en ...[truncated 541 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to a reviewed, immutable version or Homebrew formula revision rather than tracking the mutable latest release. 2. Verify the downloaded artifact using a publisher-provided cryptographic signature or a documented SHA-256 checksum before execution. 3. Document the expected package publisher, repository, release artifact, and integrity value so substitutions can be detected. 4. Require explicit user approval before installing the external executable. 5. Perform installation and execution with least privilege in a sandbox or isolated environment. 6. Restrict the process to only the credentials, local files, and network destinations required for the requested task. 7. Establish a controlled upgrade process in which new CLI versions are reviewed and their integrity metadata updated before use.