T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned Executable Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:20-24`, `SKILL.md:31`, and `SKILL.md:47` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium The skill repeatedly instructs users to install the Google Wire executable using the mutable `latest` version selector. ```yaml install: - kind: go package: github.com/google/wire/cmd/wire@latest bins: [wire] ``` ```markdown - wire: `go install github.com/google/wire/cmd/wire@latest` ``` ```bash go get -tool github.com/google/wire/cmd/wire@latest go get github.com/google/wire ``` ### Technical Analysis The `@latest` selector resolves the executable dependency at installation time rather than selecting a fixed, reviewed release. Consequently, two developers or CI jobs following the same instructions at different times may install different code. The dependency points to the official Google Wire module, and the audit found no evidence of typosquatting, dependency confusion, or a currently malicious release. Nevertheless, installing a mutable executable version creates a supply-chain exposure: a compromised upstream publication path, repository, maintainer account, or unsafe future release could cause unreviewed code to be installed and subsequently executed. This concern is especially relevant because the installed artifact is a command-line executable rather than a passive documentation dependency. The resulting `wire` binary is expected to run against source repositories and therefore receives the access granted to the invoking developer or CI process. ### Attack Path 1. An attacker compromises the upstream module release process, maintainer credentials, repository, or another component involved in publishing a future Google Wire release. 2. The attacker publishes a malicious release that Go resolves through the `@latest` selector. 3. A developer or CI runner follows the skill instructions and installs `github.com/google/wire ...[truncated 1139 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every `@latest` installation instruction with a specific, reviewed release. For example: ```bash go install github.com/google/wire/cmd/wire@v0.7.0 go get -tool github.com/google/wire/cmd/wire@v0.7.0 go get github.com/google/wire@v0.7.0 ``` 2. Update the metadata declaration to use the same pinned version: ```yaml install: - kind: go package: github.com/google/wire/cmd/wire@v0.7.0 bins: [wire] ``` 3. Keep the pinned version consistent across metadata, dependency documentation, setup commands, and CI examples. 4. Review version upgrades explicitly rather than resolving them automatically. Validate release provenance, inspect relevant upstream changes, and test generated output before updating the pinned version. 5. Retain Go checksum verification and use a controlled module proxy or approved dependency mirror in sensitive CI environments. 6. Run dependency installation and code generation in a least-privileged, isolated CI job without unnecessary production credentials.