T08 · Insecure Dependencies
- Location
SKILL.md:20- Finding
Execution of Unreviewed Third-Party Repository and Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 20–29
Vulnerability Type: Supply-chain risk from externally retrieved code and Python dependencies
Risk Level: MediumVulnerable Code
markdown ## 安装前须知 本 Skill 会指导安装并运行来自 GitHub 的第三方仓库。**供应链风险**：clone + pip install 会执行外部代码，若仓库被篡改存在风险。安装前请：(1) 检查仓库与 requirements.txt 的依赖；(2) **建议使用 release tag 固定版本**（如 `git clone --branch v1.0.1`）；(3) 在隔离环境或容器中运行，避免 root；(4) 凭证仅存 .env，勿提交到版本库；(5) 确认信任 api.pearktrue.cn 及仓库维护者。 ## 安装 fastfish-hot（首次使用必读） 1. 克隆仓库：`git clone --branch v1.0.1 https://github.com/superxs777/fastfish-hot.git`（**推荐指定 tag 固定版本**，避免 main 分支变更） 2. 进入目录：`cd fastfish-hot` 3. 安装依赖：`pip install -r requirements.txt` 4. 配置：`copy .env.example .env`，填写 Webhook 等（见 metadata.credentials） 5. 初始化：`python scripts/init_db.py`，`python scripts/init_default_config.py`，`python scripts/init_default_push_config.py`（钉钉用 `--channel dingtalk`） 6. 可选：`python run.py` 启动管理界面（http://127.0.0.1:8900）Technical Analysis
The Skill delegates its executable functionality to a third-party GitHub repository that is not included in the audited project. It then instructs the user or agent to install dependencies from the repository's
requirements.txtand execute several retrieved Python scripts.Selecting the
v1.0.1Git tag reduces exposure to ordinary branch updates but does not provide an immutable or cryptographically verified source pin. A repository administrator or compromised account may move or recreate a tag. The project also does not include a reviewed lockfile, exact dependency versions, package hashes, or the referenced scripts, so the effective runtime payload cannot be verified from the audited artifact.The document acknowledges this supply-chain risk and recommends isolation and non-root execution. These safeguards reduce risk but are advisory and do not technically enforce source integrity or isolation.
Attack Path
- An attacker compro ...[truncated 1813 chars]
- Remediation
View remediation
Remediation Suggestions
- Vendor the required, reviewed scripts into the Skill package so their contents are available during audit.
- Pin the external repository to a reviewed commit SHA rather than relying only on a mutable Git tag.
- Verify the selected commit using an authenticated signature or an expected archive checksum before executing any retrieved content.
- Replace the unconstrained dependency installation process with a reviewed lockfile containing exact versions and cryptographic hashes. Install with hash verification enabled.
- Review direct and transitive dependencies for dependency confusion, typosquatting, known vulnerabilities, and unexpected build-time execution.
- Install into a dedicated virtual environment or isolated container under a non-root service account with minimal filesystem and network permissions.
- Prevent installation and initialization processes from receiving messaging credentials. Provide secrets only to the final runtime process that needs them.
- Restrict outbound network access to the explicitly required API and messaging endpoints after validating their necessity.
- Require explicit user confirmation after presenting the resolved commit and dependency set, before installing or executing external code.
- Document a verified upgrade process in which each new commit and dependency set is reviewed before deployment.