T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:218
- Finding
- Optional Third-Party SDK Installation Introduces Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 218–231 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```bash pip install scavio==0.15.0 ``` ```python from scavio import ScavioClient client = ScavioClient() # reads SCAVIO_API_KEY apps = client.app_store.search("habit tracker", limit=200, country="us") app = client.app_store.app("notion.id") reviews = client.app_store.reviews("1232780281", page=1, sort="most_helpful") ``` ```bash npm install scavio@0.15.0 ``` ```js import { Scavio } from "scavio"; const scavio = new Scavio(); // reads SCAVIO_API_KEY const apps = await scavio.appStore.search({ term: "habit tracker", limit: 200 }); const reviews = await scavio.appStore.reviews({ app_id: "1232780281", page: 1 }); ``` ### Technical Analysis The Skill instructs users or agents to install executable third-party packages from public Python and npm registries. Pinning both packages to version `0.15.0` limits unexpected version drift, but it does not verify package integrity or provenance. The Skill provides no cryptographic hashes, package signatures, lockfiles, verified source references, or dependency review information. Package installation can execute package-controlled setup logic or npm lifecycle scripts. Installed packages also execute within the calling process when imported. In this case, the SDK explicitly reads `SCAVIO_API_KEY`, meaning a compromised package or transitive dependency could access that credential. This installation is not required for the declared functionality because the same document provides direct HTTPS request examples. Consequently, installing an SDK grants locally executable third-party code more privilege than the minimum needed to query the documented API. No evidence was found that the named packages or pinned releases are currently malicious. The finding concerns the unverified supply-chain trust introduced by the installation instructions ...[truncated 1624 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer the documented direct HTTPS workflow, which requires no locally executable SDK and is sufficient for the Skill's declared functionality. 2. Clearly mark both SDK installation paths as optional rather than presenting them as a required setup step. 3. Publish cryptographic hashes or other integrity-verification information for approved package artifacts. 4. Provide lockfiles that pin transitive dependencies, not only the top-level SDK version. 5. Link to verified source repositories and document how the published artifacts correspond to reviewed source revisions. 6. Review package ownership, release provenance, installation hooks, and transitive dependencies before recommending a release. 7. For npm, recommend disabling lifecycle scripts where compatible, such as using `npm install --ignore-scripts`, after confirming that the SDK does not require them. 8. Install dependencies in an isolated virtual environment or restricted container under a non-privileged account. 9. Expose only `SCAVIO_API_KEY` to the process when necessary and avoid running the SDK in an environment containing unrelated secrets. 10. Rotate and revoke the API key promptly if package compromise or unexpected API use is suspected. ]]>