T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:173
- Finding
- Unpinned Third-Party CLI Package Installation## Vulnerability Details **File Location**: `SKILL.md:173-176` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown For the standalone Python entry, Python 3.9 or later is required. Install or upgrade only when the user authorizes changing the Python environment: ```bash python3 -m pip install --upgrade maxc-cli ``` ``` The same unsafe installation pattern also appears at `references/setup-install.md:42-48`: ```markdown Only after the user authorizes the package change: ```bash python3 -m pip install --upgrade maxc-cli maxc --version maxc --help ``` ``` ### Technical Analysis The Skill instructs the agent to install or upgrade `maxc-cli` without specifying an exact audited version or verifying artifact integrity with cryptographic hashes. The `--upgrade` option resolves a mutable package release and its transitive dependencies at execution time. Python package installation may execute package-controlled build or installation logic. Consequently, the effective code is not fully represented by the audited Skill and can change after this review. Requiring user approval reduces accidental environment modification but does not address package-index compromise, a malicious future release, compromised maintainer credentials, or a malicious transitive dependency. The documentation references official Alibaba Cloud resources and does not use a visibly suspicious package name or custom package index. Therefore, this is an insecure supply-chain pattern rather than evidence that the current package is malicious. ### Attack Path 1. The Alibaba Cloud CLI is unavailable or unsuitable, causing the standalone Python fallback to be selected. 2. The user authorizes the requested package installation or upgrade. 3. The agent runs: ```bash python3 -m pip install --upgrade maxc-cli ``` 4. Pip resolves the latest available package and transitive dependency versions from its configured index. 5 ...[truncated 1255 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `maxc-cli` to an explicitly reviewed version rather than resolving the latest release: ```bash python3 -m pip install "maxc-cli==<reviewed-version>" ``` 2. Use a lock file containing hashes for the package and all transitive dependencies. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 3. Obtain package artifacts from a verified official source or a trusted internal package mirror with provenance controls. 4. Verify package signatures, checksums, or attestations where the publisher provides them. 5. Install the package in an isolated virtual environment rather than the user's global Python environment: ```bash python3 -m venv <dedicated-environment> <dedicated-environment>/bin/python -m pip install --require-hashes -r requirements.lock ``` 6. Separate dependency-update approval from ordinary Skill execution. Review and update the pinned version through a controlled maintenance process. 7. Continue requiring explicit user authorization before installation, but clarify that authorization alone does not establish package integrity. 8. Apply the same hardened command consistently in both `SKILL.md` and `references/setup-install.md` to prevent the unsafe fallback from remaining in secondary documentation.