T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:36
- Finding
- Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, line 36 **Vulnerability Type**: Unpinned and mutable third-party dependency **Risk Level**: Medium **Complete Code Snippet**: ```bash pip install ollama-herd # PyPI: https://pypi.org/project/ollama-herd/ ``` ### Technical Analysis The quick-start instruction installs `ollama-herd` from the configured Python package index without an exact version constraint or integrity hash. Consequently, the code installed by this command can change after the Skill has been reviewed. Python package installation may execute package-controlled build or installation logic. The installed package and its transitive dependencies also execute when the documented `herd` and `herd-node` commands are subsequently launched. The package source is not included in the audited project, so its behavior could not be verified as part of this audit. This is a supply-chain weakness rather than evidence that the currently published package is malicious. Exploitation requires compromise of a future package release, a dependency, the selected package index, or the user's package-resolution configuration. ### Attack Path 1. An attacker compromises the `ollama-herd` publishing account, one of its dependencies, or a package index used by the victim. 2. The attacker publishes a malicious release that satisfies the unrestricted package request. 3. A user follows the documented quick-start command. 4. `pip` resolves and downloads the attacker-controlled release or dependency. 5. Malicious code executes during package installation, import, or subsequent invocation of `herd` or `herd-node`. 6. The payload operates with the privileges of the account that performed the installation or launched the service. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that account's access, the payload could read or modify user file ...[truncated 664 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the unrestricted installation command with an exact, reviewed release, for example: ```bash python3 -m pip install "ollama-herd==<reviewed-version>" ``` 2. Publish a lock file or requirements file containing exact versions for the package and all transitive dependencies. 3. Record and verify distribution hashes, and install with pip's `--require-hashes` option: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Explicitly specify the trusted package index and warn users that custom `pip` index configuration can alter package resolution. 5. Recommend installation in a dedicated virtual environment under an unprivileged service account rather than with `sudo` or an administrator account. 6. Review each pinned release and its dependency changes before updating the documented version and hashes. 7. Where practical, provide signed release artifacts, attestations, or reproducible-build information so users can validate package provenance.