T08 · Insecure Dependencies
Error
- Location
- SKILL.md:21
- Finding
- Unpinned Third-Party Package Is Installed and Immediately Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 21-25 **Vulnerability Type**: Unverified and unpinned third-party dependency installation **Risk Level**: High **Vulnerable Code**: ```bash Run these on the host machine (not inside the OpenClaw container): ```bash pip install agentic-ledger agenticledger start agenticledger connect openclaw ``` ``` ### Technical Analysis The setup instructions install `agentic-ledger` without specifying a version, package hash, lockfile, trusted artifact URL, or source verification procedure. The newly installed package is then immediately executed on the host. This dependency operates in a highly sensitive position: it modifies OpenClaw configuration and acts as a proxy for model-provider traffic. According to the Skill documentation, that traffic includes prompts, responses, authorization data forwarded to the provider, token usage, costs, and errors. Consequently, the integrity of the dependency is part of the security boundary. Installing an unpinned package allows the effective code to change after this Skill has been reviewed. A compromised package registry account, malicious future release, dependency-confusion condition, or compromised transitive dependency could cause users to execute attacker-controlled code. ### Attack Path 1. An attacker compromises the package publisher, package distribution channel, or a transitive dependency used by `agentic-ledger`. 2. The attacker publishes a malicious version under the package name selected by the unpinned installation command. 3. A user follows the Skill instructions and runs `pip install agentic-ledger`. 4. The package manager selects the malicious or compromised release. 5. The user executes `agenticledger start` and `agenticledger connect openclaw`. 6. The compromised package executes with the user's host privileges, accesses or changes OpenClaw configuration, and can observe model traffic passing through th ...[truncated 828 chars]
- Remediation
- ## Remediation Suggestions - Pin `agentic-ledger` to a specifically reviewed version rather than installing the newest available release. - Distribute a lockfile containing cryptographic hashes and require hash verification during installation, for example: ```bash pip install --require-hashes -r requirements.lock ``` - Pin and verify all transitive dependencies, not only the top-level package. - Document the canonical package publisher, source repository, release-signing process, and expected package hash. - Prefer a reviewed wheel or other immutable artifact obtained from a trusted release channel. - Run the proxy under a dedicated, minimally privileged operating-system account with access only to required configuration and storage locations. - Restrict outbound network access to the explicitly configured model providers. - Verify updates in a controlled environment before changing the pinned production version.