T08 · Insecure Dependencies
Warning
- Location
- clawhub.json:8
- Finding
- Unbounded Third-Party SDK Version Exposes API Credentials to Supply-Chain Risk## Vulnerability Details **File Location**: `clawhub.json:8-10` (dependency declaration); related privileged use at `preflight.py:64-101` **Vulnerability Type**: Unpinned third-party dependency with access to sensitive credentials **Risk Level**: Medium ### Vulnerable Code `clawhub.json:8-10`: ```json "pip": [ "simmer-sdk>=0.17.13" ] ``` The dependency is imported and given the API credential in `preflight.py:64-101`: ```python api_key = os.environ.get("SIMMER_API_KEY") if not api_key: print("ERROR: SIMMER_API_KEY not set", file=sys.stderr) return 2 try: import simmer_sdk as _sdk_mod from simmer_sdk import SimmerClient except ImportError: print( f"ERROR: simmer-sdk not installed — run: pip install 'simmer-sdk>={_SDK_MIN_VERSION}'", file=sys.stderr, ) return 2 _installed_ver = getattr(_sdk_mod, "__version__", "") if not _sdk_meets_floor(_installed_ver): print( f"ERROR: simmer-sdk {_installed_ver or '?'} is below the required >={_SDK_MIN_VERSION} " f"— run: pip install 'simmer-sdk>={_SDK_MIN_VERSION}'", file=sys.stderr, ) return 2 try: client = SimmerClient.readonly(api_key=api_key, venue=_venue) except ValueError as e: print(f"ERROR: {e}", file=sys.stderr) return 2 pf = client.preflight( venue=_venue, planned_amount=planned_amount, exposure_cap_usd=_cap, ) ``` ### Technical Analysis The version constraint accepts version `0.17.13` and every later release. Consequently, installation at different times can resolve to different package code without any corresponding change to the reviewed Skill. Python executes package-level code as soon as `simmer_sdk` is imported. The SDK then receives `SIMMER_API_KEY` directly through `SimmerClient.readonly()`. It operates in the same process as the Skill and is not sandboxed, so package code can access the pr ...[truncated 2362 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the open-ended requirement with an exact, reviewed version: ```json "pip": [ "simmer-sdk==0.17.13" ] ``` 2. Install from a hash-locked requirements file or equivalent lock mechanism, for example: ```text simmer-sdk==0.17.13 \ --hash=sha256:REVIEWED_DISTRIBUTION_HASH ``` Include hashes for all transitive dependencies as well. 3. Configure installation to use an explicitly trusted package index and disallow unexpected extra indexes. Preserve TLS certificate verification. 4. Review package source and release changes before updating the pinned version. Perform updates through a controlled pull request that refreshes both the version and verified hashes. 5. Run the Skill under a dedicated, minimally privileged operating-system account or container. Restrict readable files, inherited environment variables, and outbound destinations to those required by the Simmer API. 6. Provision the API key with the minimum server-side permissions required for read-only preflight operations, rotate it periodically, and revoke it immediately if dependency compromise is suspected. 7. Avoid writing full `--json` results to broadly accessible logs because they can include account identity, wallet addresses, balances, exposure, and risk alerts. Apply log access controls and retention limits.