T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unpinned Executable Dependency Installed from a Custom Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Supply-chain risk from an unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml metadata: {"clawdbot":{"emoji":"🗣️","requires":{"bins":["sag"],"env":["ELEVENLABS_API_KEY"]},"primaryEnv":"ELEVENLABS_API_KEY","install":[{"id":"brew","kind":"brew","formula":"steipete/tap/sag","bins":["sag"],"label":"Install sag (brew)"}]}} ``` ### Technical Analysis The skill directs the host environment to install the `sag` executable from the custom Homebrew tap `steipete/tap`. The dependency is identified only by its mutable formula name, `steipete/tap/sag`; no immutable version, source commit, checksum, or cryptographic signature is specified. Consequently, the code installed in the future may differ from the dependency that was reviewed. If the tap, formula, upstream release infrastructure, or maintainer account is compromised, a malicious package could be distributed under the expected name. Homebrew installation logic may execute package lifecycle operations, while later invocations of `sag` execute the installed binary directly. The skill also requires `ELEVENLABS_API_KEY` and passes user-provided text to this executable. A compromised dependency could therefore read the API credential from its process environment, capture text submitted for speech synthesis, access files available to the executing account, or run arbitrary commands with that account's privileges. This finding establishes an insecure dependency configuration and supply-chain exposure. It does not establish that the current `sag` package or its maintainer is malicious. ### Attack Path 1. An attacker compromises the custom Homebrew tap, its maintainer account, the referenced upstream artifact, or another part of its release pipeline. 2. The attacker modifies the `sag` formula or distributed artifact while retaining the expected package and executable name ...[truncated 1199 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer an official and independently verifiable distribution channel for the `sag` executable. 2. Pin the dependency to an immutable release version or source commit rather than a mutable Homebrew formula reference. 3. Verify downloaded artifacts using a trusted cryptographic checksum or signature before installation. 4. Review and lock the Homebrew formula and all transitive download locations used by that formula. 5. Use a dependency allowlist and periodically verify the publisher, repository ownership, release history, and signing keys. 6. Run the executable under a dedicated, least-privileged account or sandbox with restricted filesystem and network access. 7. Provide `ELEVENLABS_API_KEY` only to a verified executable and use a narrowly scoped, revocable API key with usage limits. 8. Avoid exposing unrelated environment variables to the child process. 9. Record the approved package version and integrity digest in `SKILL.md` or in a locked installation manifest so future changes require explicit review. ]]>