T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:28
- Finding
- Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 28-34 **Vulnerability Type**: Unpinned dependencies installed from public package registries **Risk Level**: Medium ```bash pip install ollama-herd # PyPI: https://pypi.org/project/ollama-herd/ herd # start the router (port 11435) herd-node # run on each device — finds the router automatically # Install image generation backends uv tool install mflux # Flux models (~7s at 512px) uv tool install diffusionkit # Stable Diffusion 3/3.5 ``` ### Technical Analysis The setup instructions install `ollama-herd`, `mflux`, and `diffusionkit` without version constraints, hashes, a lockfile, or an authenticated artifact-verification procedure. Consequently, the effective code installed by these commands can change after the Skill has been reviewed. Installation from a public registry is necessary for the documented setup, but installing unconstrained latest releases is not the minimum-risk method. If a package, maintainer account, release pipeline, or transitive dependency is compromised, a user following these instructions could install attacker-controlled code. The subsequent execution of `herd` and `herd-node` would then run that code. The static pre-scan warning concerning lines 112, 115, and 118 is not confirmed as remote payload execution. Those commands retrieve JSON from a loopback HTTP service and pipe it to `python3 -m json.tool`, which parses and formats data rather than executing it as shell code: ```bash curl -s http://localhost:11435/fleet/status | python3 -m json.tool curl -s http://localhost:11435/dashboard/api/recommendations | python3 -m json.tool curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool ``` ### Attack Path 1. An attacker compromises one of the named packages, its maintainer account, its release process, or a transitive dependency. 2. The attacker publish ...[truncated 1403 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to a reviewed, immutable version, for example: ```bash python3 -m pip install "ollama-herd==<reviewed-version>" uv tool install "mflux==<reviewed-version>" uv tool install "diffusionkit==<reviewed-version>" ``` 2. Provide a lockfile or constraints file covering transitive dependencies, and regenerate it only through a controlled review process. 3. Use hash verification where supported, such as `pip install --require-hashes -r requirements.txt`, with hashes sourced from a trusted release process. 4. Publish verified package names, versions, checksums, and expected maintainers in the documentation to reduce dependency-confusion and package-substitution risk. 5. Recommend installation in an isolated virtual environment or dedicated tool environment rather than into a global Python environment. 6. Review package provenance, release signatures or attestations, and upstream changes before updating pinned versions. 7. Avoid running installation or tool commands with `sudo` or an administrative account.