T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party Go Dependency Installed from a Mutable Source## Vulnerability Details **File Location**: `SKILL.md`, lines 6 and 14 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Complete Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"📰","requires":{"bins":["blogwatcher"]},"install":[{"id":"go","kind":"go","module":"github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest","bins":["blogwatcher"],"label":"Install blogwatcher (go)"}]}} ``` ```markdown - Go: `go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest` ``` ### Technical Analysis Both installation declarations use the mutable `@latest` selector for a third-party Go module. Consequently, the installed source is determined at installation time rather than being tied to a version that was reviewed with this skill. If the upstream repository, release process, maintainer account, or module distribution path is compromised, `@latest` can resolve to a malicious future release. The resulting executable would then be trusted under the legitimate `blogwatcher` name. The skill does not specify an audited version, verify an expected checksum independently, or otherwise constrain the installed artifact to the implementation reviewed by the skill author. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its release process. 2. The attacker publishes a newer malicious version of `github.com/Hyaxia/blogwatcher/cmd/blogwatcher`. 3. A user or agent follows the skill installation metadata or documented command. 4. Go resolves `@latest` to the attacker-controlled version and installs it as `blogwatcher`. 5. The user or agent invokes a documented command such as `blogwatcher scan`. 6. The malicious executable runs with the privileges and environment of that user or agent. ### Impact Assessment Successful exploitation can execute attacker-controlled behavior with the privileges of the account running `blogwatcher`. Depending on that account's ...[truncated 382 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` in both installation declarations with a specific, reviewed semantic version, for example: ```bash go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@vX.Y.Z ``` - Update the metadata module field to use the same pinned version so automated and manual installation paths remain consistent. - Review the source and dependency graph of the selected release before pinning it. - Use Go's checksum database and module verification, and consider independently validating release provenance or a known artifact digest. - Introduce a controlled dependency-update process that reviews and tests each new version before changing the pin. - Run the installed CLI under a least-privileged account and avoid exposing unnecessary secrets in its environment.