T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned CLI Installation from a Third-Party Homebrew Tap## Vulnerability Details **File Location**: `SKILL.md`, lines 13–17 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: brew formula: runapi-ai/tap/runapi bins: - runapi ``` ### Technical Analysis The skill requires installation of the `runapi` executable from the external `runapi-ai/tap` Homebrew tap without specifying a version, immutable commit, expected checksum, or signature-verification procedure. Consequently, the installed executable depends on the mutable formula and artifacts served by the third-party source at installation time. If the tap repository, package release infrastructure, artifact hosting, or publisher account is compromised, an attacker could replace the expected CLI with a malicious executable. The substituted CLI would subsequently be invoked by the skill for authentication, request submission, local file processing, and result retrieval. This is a supply-chain weakness rather than evidence that the current package is malicious. The risk arises because the instructions do not provide controls that allow an agent or user to verify that the installed executable is the version that was reviewed. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its publisher account, or the referenced release infrastructure. 2. The attacker modifies the formula or downloadable artifact so that it installs a malicious `runapi` executable. 3. A user or agent follows the skill metadata and installs `runapi-ai/tap/runapi`. 4. Homebrew retrieves and installs the attacker-controlled dependency because the skill does not require an audited version or independent integrity check. 5. The skill invokes the compromised executable for operations such as `runapi auth status`, `runapi auth import-token`, task submission, or local media upload. 6. The executable runs with the privileges of the invoking user and can access ...[truncated 860 chars]
- Remediation
- ## Remediation Suggestions - Pin the CLI to a specific, reviewed release rather than relying on an implicitly mutable latest version. - Require verification of the downloaded artifact using a publisher-provided cryptographic signature or a documented SHA-256 checksum obtained through a trusted channel. - Pin or otherwise verify the Homebrew tap revision so changes to the formula can be reviewed before installation. - Document the authoritative repository, release page, signing identity, and expected artifact provenance. - Avoid automatic installation when the dependency's provenance or integrity cannot be established; stop and ask the user to install a verified release instead. - Execute the CLI without administrator privileges and restrict its access to credentials and local files to the minimum necessary for the requested operation. - In production environments, use a lockfile or similarly reproducible dependency mechanism and incorporate dependency provenance and integrity validation into CI.