T08 · Insecure Dependencies
Warning
- Location
- clawhub.json:5
- Finding
- Unbounded Third-Party SDK Dependency Can Introduce Unreviewed Code## Vulnerability Details **File Location**: `clawhub.json:5-9`; dependency import and API-key use at `preflight.py:63-71` **Vulnerability Type**: Unbounded third-party dependency / supply-chain risk **Risk Level**: Medium ### Vulnerable Code `clawhub.json:5-9`: ```json "requires": { "env": [ "SIMMER_API_KEY" ], "pip": [ "simmer-sdk>=0.17.13" ] } ``` `preflight.py:63-71`: ```python try: from simmer_sdk import SimmerClient except ImportError: print("ERROR: simmer-sdk not installed — run: pip install simmer-sdk>=0.17.13", file=sys.stderr) return 2 try: client = SimmerClient.readonly(api_key=api_key, venue=_venue) except ValueError as e: ``` ### Technical Analysis The dependency declaration specifies only a minimum version and does not impose an upper bound, exact version, or package hash. Dependency resolution can therefore install any future release satisfying `simmer-sdk>=0.17.13`, even if that release has not been reviewed with this Skill. Python executes package-level code when `simmer_sdk` is imported. The resulting third-party `SimmerClient` implementation also receives the sensitive `SIMMER_API_KEY`. Consequently, a compromised or malicious future package release could execute arbitrary code in the Agent process and intercept the API key. The reviewed repository does not contain evidence that the current SDK version is malicious. This finding concerns the absence of dependency integrity and version controls, which creates a supply-chain exploitation path. ### Attack Path 1. An attacker compromises the package publisher account, package distribution channel, or a future compatible `simmer-sdk` release. 2. The attacker publishes a version higher than `0.17.13` containing malicious import-time or client-initialization code. 3. A new installation or dependency update resolves the unconstrained requirement to the compromised version. 4. Invoc ...[truncated 1116 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the lower-bound requirement with an exact, reviewed version, for example: ```json "pip": [ "simmer-sdk==0.17.13" ] ``` 2. Maintain dependencies in a lock file containing cryptographic hashes and install them with hash verification, such as pip's `--require-hashes`. 3. Review SDK release notes and source changes before deliberately updating the pinned version. 4. Obtain packages only from an approved package index and verify package publisher ownership and provenance. 5. Run the Skill with restricted filesystem and network permissions so a compromised dependency cannot access unrelated credentials or destinations. 6. Provide the process only with the specific API key needed for preflight and ensure that the key has read-only, least-privilege permissions. 7. Where feasible, vendor or independently audit the small portion of SDK functionality required by the Skill.