T08 · Insecure Dependencies
Warning
- Location
- install.sh:4
- Finding
- Unverified Third-Party Source Download and Installation## Vulnerability Details **File Location**: `install.sh`, lines 4-7 **Vulnerability Type**: Supply-chain risk from remotely retrieved source and transitive dependencies **Risk Level**: Medium ### Vulnerable Code ```bash echo "Source: https://github.com/sirToby99/swipenode" # Pinned to a specific version for security and reproducible builds go install github.com/sirToby99/swipenode@v1.6.4 ``` ### Technical Analysis The installation script uses `go install` to retrieve, compile, and install code from an external GitHub-hosted Go module. Although the module is pinned to version tag `v1.6.4`, the project does not provide an independently verified commit identifier, expected source or artifact hash, signature, vendored source tree, or reproducible-build verification procedure. Consequently, the effective implementation and its transitive dependencies are not available for review within this skill package. Trust is delegated to the upstream repository, Go module distribution infrastructure, and all relevant dependencies. If any of those sources are compromised, the downloaded executable could contain behavior that was not present during this audit. There is also a version-provenance inconsistency: `SKILL.md` declares skill version `1.6.3`, while `install.sh` installs SwipeNode `v1.6.4`. This makes it harder for users and reviewers to determine which implementation corresponds to the audited package. The audit did not find evidence that the supplied shell script itself performs privilege escalation or persistence. The installation normally operates with the invoking user's privileges and writes to the configured Go binary directory. The risk arises when the remotely built executable is subsequently invoked. ### Attack Path 1. An attacker compromises the upstream repository, release process, module-distribution path, or a required transitive dependency before installation. 2. Malicious behavior is introduced into the source associated with the requested module ...[truncated 1500 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the complete, auditable source code required to build the executable, including an appropriate dependency lock state, so reviewers can inspect the implementation distributed with the skill. 2. Pin the upstream source to an immutable, reviewed commit and document the relationship between that commit and the declared release. 3. Publish signed release artifacts and verify both the signature and a cryptographic hash before installation. 4. Use reproducible builds and publish expected build hashes so users can confirm that binaries correspond to reviewed source. 5. Retain and verify Go module checksums, review all direct and transitive dependencies, and use automated dependency and provenance scanning. 6. Align the version declared in `SKILL.md` with the version installed by `install.sh`. 7. Avoid running installation or the resulting executable with administrative privileges; use a dedicated, minimally privileged account or sandbox with restricted filesystem and network access. 8. Document the executable's required outbound destinations and data handling, and restrict outbound access to target sites when operationally feasible.