T08 · Insecure Dependencies
Warning
- Location
- README.md:15
- Finding
- Unpinned External Repository and Unverified Executable Create a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md:15-18`; `scripts/run.sh:4-13` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium The documented installation procedure clones the current default branch of a third-party repository and immediately runs its Bun scripts without pinning a reviewed commit, validating a signature, or checking a cryptographic digest: ```sh git clone https://github.com/kimhyejoo/ralphy-claw cd ralphy-claw bun run setup bun run install-skill ``` The Skill wrapper subsequently obtains the repository path from `.repo-path` or a relative directory and delegates execution to a binary outside the audited package: ```sh if [ -f "$ralphy_skill_dir/.repo-path" ]; then IFS= read -r ralphy_repo < "$ralphy_skill_dir/.repo-path" else ralphy_repo=$(CDPATH='' cd -- "$ralphy_skill_dir/../.." && pwd) fi if [ ! -x "$ralphy_repo/bin/ralphy-claw" ]; then echo 'ralphy-claw repository unavailable. Reinstall this skill with bun run install-skill.' >&2 exit 1 fi exec "$ralphy_repo/bin/ralphy-claw" "$@" ``` ### Technical Analysis The effective implementation is not contained in the audited Skill. Instead, the setup instructions retrieve a mutable external repository and execute its package scripts. Since no commit hash, signed release, checksum, or integrity policy is specified, the downloaded code can change after this Skill has been reviewed. At runtime, `scripts/run.sh` verifies only that `bin/ralphy-claw` exists and has its executable bit set. It does not establish the executable's provenance or integrity. The executable receives all supplied command-line arguments and runs with the same operating-system privileges and environment as the invoking Agent. This creates a supply-chain trust boundary: compromise of the external repository, its maintainer account, its dependencies, the local checkout, or the configured repository path can alter the code executed by an otherwise legitimate-looking Skil ...[truncated 1727 chars]
- Remediation
- ## Remediation Suggestions 1. Pin installation to an explicitly reviewed commit hash or immutable release tag rather than the repository's current default branch. 2. Publish signed releases and verify the signature before running any setup or installation command. 3. Publish a SHA-256 or stronger digest for the approved archive and runtime executable, and reject mismatches. 4. Vendor the reviewed executable into the Skill package where practical so the audited artifact represents the effective implementation. 5. If external installation remains necessary, verify `bin/ralphy-claw` against an allowlisted digest immediately before every execution. 6. Validate `.repo-path` by requiring an absolute canonical path under an approved installation directory; reject unexpected, missing, writable, or symlinked targets where appropriate. 7. Restrict write access to the installed repository and executable to trusted administrators or the owning user. 8. Audit and lock Bun dependencies with an immutable lockfile, integrity metadata, and automated dependency scanning. 9. Run the delegated executable with least privilege, a minimal environment, and only the filesystem and network access required for the declared task.