T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Executable Installed from a Third-Party Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"💎","requires":{"bins":["obsidian-cli"]},"install":[{"id":"brew","kind":"brew","formula":"yakitrak/yakitrak/obsidian-cli","bins":["obsidian-cli"],"label":"Install obsidian-cli (brew)"}]}} ``` ### Technical Analysis The skill declares `obsidian-cli` as a required executable and directs the environment to install it from the third-party Homebrew tap `yakitrak/yakitrak`. The dependency is not pinned to an audited version, immutable commit, or cryptographic digest. The skill's declared homepage points to Obsidian documentation, while the executable is obtained from a separate third-party publisher. This trust distinction is not documented or verified in the skill. Because Homebrew resolves the current formula and its upstream artifacts at installation time, the effective executable can change without any corresponding modification to this repository. This creates a supply-chain exposure: compromise of the tap, its maintainer account, the upstream release infrastructure, or an artifact referenced by the formula could result in attacker-controlled code being installed. No evidence shows that the current dependency is malicious; the finding concerns the unsafe, mutable trust mechanism. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, or an upstream artifact source used by the formula. 2. The attacker changes the formula or referenced release so that it installs a malicious executable or runs malicious installation logic. 3. A user or automated agent installs the declared dependency using `yakitrak/yakitrak/obsidian-cli`. 4. Homebrew retrieves and installs the attacker-controlled dependency under the installing user's authority. 5. The agent later invokes apparently legitimate comman ...[truncated 1104 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer an officially maintained and verified distribution source for `obsidian-cli`, if one is available. 2. Pin the dependency to a specific reviewed version rather than accepting the current version from a mutable tap. 3. Verify downloaded artifacts with a trusted SHA-256 digest or equivalent cryptographic integrity mechanism. 4. Where possible, reference an immutable source revision and audit both the Homebrew formula and every upstream download URL it uses. 5. Document that `yakitrak/yakitrak` is a third-party publisher distinct from the declared Obsidian homepage, including the resulting trust assumptions. 6. Use dependency monitoring to detect formula ownership changes, unexpected checksum changes, compromised releases, and newly disclosed vulnerabilities. 7. Run the CLI with least privilege and restrict its filesystem access to the intended vault where the execution environment supports sandboxing. 8. Require manual review before accepting dependency upgrades, and retest vault read, write, move, and delete behavior after each approved update. ]]>