T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party CLI Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 13–17 **Vulnerability Type**: Unpinned third-party dependency from a mutable Homebrew tap **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: brew formula: runapi-ai/tap/runapi bins: - runapi ``` ### Technical Analysis The skill instructs the environment to install the `runapi` executable from the third-party Homebrew tap `runapi-ai/tap` without pinning an audited version, immutable source revision, checksum, or signature. Because the formula and its referenced artifacts are mutable, the executable installed in a future skill invocation may differ from the version originally reviewed. Compromise of the tap repository, its maintainer account, the release infrastructure, or a referenced binary artifact could cause attacker-controlled code to be installed and executed. The risk is amplified by the CLI's legitimate access to the RunAPI authentication configuration and user-provided media. No evidence shows that the current dependency is malicious; this finding concerns the absence of controls that bind installation to a reviewed artifact. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, a maintainer account, or an artifact distribution endpoint used by its formula. 2. The attacker modifies the formula or replaces a referenced release artifact with a malicious executable. 3. The skill is installed or updated using the mutable formula name `runapi-ai/tap/runapi`. 4. Homebrew retrieves and installs the attacker-controlled version. 5. The agent invokes `runapi` as required by the skill. 6. The malicious process executes with the invoking user's privileges and can attempt to access RunAPI credentials, submitted media, generated artifacts, and other resources available to that user. ### Impact Assessment Successful exploitation could result in arbitrary code execution with the privileges of the user installing or running the CLI. The accessible scope may ...[truncated 403 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the CLI to a specific, audited release rather than installing the latest version from a mutable formula. 2. Bind installation to an immutable artifact digest, such as a SHA-256 checksum, and fail closed if verification does not succeed. 3. Verify a trusted publisher signature or provenance attestation before executing the downloaded artifact. 4. Pin or otherwise validate the Homebrew tap revision and review formula changes before upgrades. 5. Document the official artifact source, expected version, checksum, and signer identity in the skill. 6. Perform dependency upgrades through an explicit review process rather than allowing transparent installation of future releases. 7. Run the CLI with least privilege and restrict its access to credentials and media files not required for the current task.