T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:203
- Finding
- Unaudited Third-Party SDK Installation Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 203-221 **Vulnerability Type**: Third-party software supply-chain exposure **Risk Level**: Medium **Relevant Code:** ```bash pip install scavio==0.15.0 ``` ```python from scavio import ScavioClient client = ScavioClient() # reads SCAVIO_API_KEY apps = client.google_play.search("habit tracker", gl="us") app = client.google_play.app("com.spotify.music") page1 = client.google_play.reviews("com.spotify.music", sort="rating", count=200) page2 = client.google_play.reviews("com.spotify.music", sort="rating", count=200, cursor=page1["data"]["next_cursor"]) ``` ```bash npm install scavio@0.15.0 ``` ```js import { Scavio } from "scavio"; const scavio = new Scavio(); // reads SCAVIO_API_KEY const app = await scavio.googlePlay.app({ app_id: "com.spotify.music" }); ``` ### Technical Analysis The Skill instructs users to install the third-party `scavio` packages from Python and npm package registries. Although both dependencies are pinned to version `0.15.0`, the project provides no lockfile, artifact integrity hash, signature, verified provenance information, or vendored source with which to validate the retrieved packages. Package installation can execute package-controlled build hooks or lifecycle scripts with the privileges of the user running the package manager. The imported SDK also executes in the Agent's process and explicitly reads `SCAVIO_API_KEY`. Because the dependency source and registry artifacts are not included in the audited project, their behavior could not be verified during this audit. This is a supply-chain risk rather than evidence that the named packages are currently malicious. Direct HTTPS requests documented elsewhere in the Skill already implement the declared functionality, so installing an additional SDK is not strictly necessary and increases the trusted computing base beyond minimu ...[truncated 1694 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer the documented direct HTTPS request implementation, which avoids installing an additional SDK and is sufficient for the declared functionality. 2. If SDK installation remains supported, provide lockfiles and cryptographic hashes for all direct and transitive artifacts. 3. Require hash-verified Python installation, such as a fully pinned requirements file used with `pip --require-hashes`. 4. Provide an npm lockfile and use `npm ci` rather than an unconstrained dependency-resolution workflow. 5. Publish and document verifiable package provenance, trusted publisher identities, release signatures, and links to the exact reviewed source revision. 6. Disable package lifecycle scripts where compatible with the package, and perform installation in an isolated, unprivileged environment. 7. Give the SDK process access only to `SCAVIO_API_KEY`; do not expose unrelated credentials or sensitive environment variables. 8. Run the Skill with restricted filesystem and network permissions, allowing outbound access only to the declared Scavio API endpoint when practical. 9. Rotate `SCAVIO_API_KEY` immediately if package compromise is suspected, and monitor the associated account for unexpected requests or credit consumption.