T08 · Insecure Dependencies
Warning
- Location
- install.sh:9
- Finding
- Unpinned Dependency Installed into the System Python Environment## Vulnerability Details **File Location**: `install.sh:9-15` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```bash pip install --break-system-packages --quiet tavily-python 2>/dev/null || { echo "⚠️ pip install failed, trying without --break-system-packages..." pip install --quiet tavily-python 2>/dev/null || { echo "❌ Failed to install tavily-python. Install manually: pip install tavily-python" exit 1 } } ``` ### Technical Analysis The installer retrieves `tavily-python` without pinning a reviewed version or verifying package integrity with hashes. Consequently, the code installed by this Skill can change after the Skill itself has been audited. The initial installation attempt also uses `--break-system-packages`, bypassing Python's externally managed environment protection. This permits pip to modify the shared system Python environment rather than isolating the dependency. Although the dependency is relevant to the declared Tavily functionality, installing an unpinned package into a shared environment exceeds the minimum package-management privileges needed for the Skill. The same unpinned dependency is declared in `SKILL.md:10`: ```yaml metadata: {"clawdbot":{"emoji":"🔎","requires":{"env":["TAVILY_API_KEY"]},"primaryEnv":"TAVILY_API_KEY","install":[{"id":"pip","kind":"pip","package":"tavily-python","label":"Install dependencies (pip)"}]}} ``` ### Attack Path 1. An attacker compromises the upstream package publisher account, package distribution process, or package-index resolution path. 2. The attacker publishes or causes resolution to a malicious or compromised `tavily-python` release. 3. A user executes `install.sh`. 4. Pip automatically resolves the mutable package name to the affected release because no version or hash is enforced. 5. Package build or installation hooks execute with the privileges of the user running the installer. 6. ...[truncated 1011 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `tavily-python` to a specifically reviewed version in both `install.sh` and `SKILL.md`. 2. Use a lock file or requirements file with cryptographic hashes, and install with `pip install --require-hashes`. 3. Create a dedicated virtual environment for the Skill rather than modifying the shared system Python environment. 4. Remove `--break-system-packages`; fail safely with instructions for creating an isolated environment. 5. Review pinned dependency releases and their transitive dependencies before updates. 6. Preserve visible pip error output or log it securely so integrity and package-resolution failures can be investigated. Example hardened approach: ```bash python3 -m venv "$SCRIPT_DIR/.venv" "$SCRIPT_DIR/.venv/bin/python" -m pip install \ --require-hashes \ -r "$SCRIPT_DIR/requirements.lock" ``` The lock file should specify an exact reviewed version and hashes for every resolved distribution.