T08 · Insecure Dependencies
- Location
clawhub.json:16- Finding
Mutable and Unverified Third-Party Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
README.md:15-18andclawhub.json:16-21
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: MediumVulnerable Code
README.md:15-18:bash pip install pyautogui paddleocr pandas opencv-pythonclawhub.json:16-21:json "dependencies": { "pyautogui": ">=0.9.53", "paddleocr": ">=2.7.0", "pandas": ">=1.5.0", "opencv-python": ">=4.7.0", "tqdm": ">=4.65.0" }Technical Analysis
The documented installation command does not constrain dependency versions, while the package manifest only specifies minimum versions. No lock file, integrity hashes, or trusted package source is defined.
Consequently, two installations performed at different times can resolve to different package releases. A compromised future release, dependency takeover, or malicious transitive dependency could execute code during package installation or import. This is particularly significant because the dependencies include large packages with extensive transitive dependency trees.
The audit did not identify a currently malicious dependency. The vulnerability is the absence of controls that ensure users receive the versions reviewed and tested by the project.
Attack Path
- An attacker compromises a declared dependency or one of its transitive dependencies and publishes a malicious release that satisfies the open-ended version constraint.
- A user follows the documented installation command or installs dependencies from the manifest.
- The package resolver selects the malicious release because no exact version or integrity hash prevents it.
- Malicious installation hooks or imported module code execute in the user's Python environment.
- That code can act with the invoking user's permissions and potentially access resources available to the Skill.
Impact Assessment
Successful exploitation could execute a ...[truncated 443 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every direct dependency to an exact, reviewed version rather than using unrestricted or minimum-only constraints.
- Generate and commit a lock file that also fixes transitive dependency versions.
- Require package integrity hashes, for example through a hash-locked requirements file and
pip install --require-hashes. - Install packages exclusively from a controlled or explicitly trusted package index.
- Add automated dependency vulnerability and provenance scanning to the release process.
- Review dependency updates before regenerating the lock file.
- Keep documentation and manifest constraints synchronized so the documented command installs the reviewed dependency set.