T08 · Insecure Dependencies
- Location
install.sh:9- Finding
Unpinned Dependency Installed into the System Python Environment
- Content
View full analysis
Vulnerability Details
File Location:
install.sh:9-15
Vulnerability Type:T08: Insecure Dependencies
Risk Level: Mediumbash pip install --break-system-packages --quiet tavily-python 2>/dev/null || { echo "⚠️ pip install failed, trying without --break-system-packages..." pip install --quiet tavily-python 2>/dev/null || { echo "❌ Failed to install tavily-python. Install manually: pip install tavily-python" exit 1 } }Technical Analysis
The installer retrieves
tavily-pythonwithout pinning a reviewed version or verifying package integrity with hashes. Consequently, the code installed by this Skill can change after the Skill itself has been audited.The initial installation attempt also uses
--break-system-packages, bypassing Python's externally managed environment protection. This permits pip to modify the shared system Python environment rather than isolating the dependency. Although the dependency is relevant to the declared Tavily functionality, installing an unpinned package into a shared environment exceeds the minimum package-management privileges needed for the Skill.The same unpinned dependency is declared in
SKILL.md:10:yaml metadata: {"clawdbot":{"emoji":"🔎","requires":{"env":["TAVILY_API_KEY"]},"primaryEnv":"TAVILY_API_KEY","install":[{"id":"pip","kind":"pip","package":"tavily-python","label":"Install dependencies (pip)"}]}}Attack Path
- An attacker compromises the upstream package publisher account, package distribution process, or package-index resolution path.
- The attacker publishes or causes resolution to a malicious or compromised
tavily-pythonrelease. - A user executes
install.sh. - Pip automatically resolves the mutable package name to the affected release because no version or hash is enforced.
- Package build or installation hooks execute with the privileges of the user running the installer.
...[truncated 1011 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
tavily-pythonto a specifically reviewed version in bothinstall.shandSKILL.md. - Use a lock file or requirements file with cryptographic hashes, and install with
pip install --require-hashes. - Create a dedicated virtual environment for the Skill rather than modifying the shared system Python environment.
- Remove
--break-system-packages; fail safely with instructions for creating an isolated environment. - Review pinned dependency releases and their transitive dependencies before updates.
- Preserve visible pip error output or log it securely so integrity and package-resolution failures can be investigated.
Example hardened approach:
bash python3 -m venv "$SCRIPT_DIR/.venv" "$SCRIPT_DIR/.venv/bin/python" -m pip install \ --require-hashes \ -r "$SCRIPT_DIR/requirements.lock"The lock file should specify an exact reviewed version and hashes for every resolved distribution.
- Pin