T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash pip install ollama-herd ``` ### Technical Analysis The setup instructions install `ollama-herd` directly from the default Python Package Index without specifying an exact version or validating package hashes. Because the executable package source is not included in the audited project, its installation behavior and runtime implementation cannot be verified from this artifact. An unpinned installation resolves to whichever release the package index serves at installation time. If the publisher account, package distribution process, package index, or a future release is compromised, users following these instructions could install attacker-controlled code. Python package installation may execute package-controlled build logic, and the installed commands (`herd` and `herd-node`) subsequently execute with the privileges of the invoking user. This finding does not establish that the current `ollama-herd` package is malicious. It identifies a supply-chain weakness caused by mutable dependency resolution and the absence of integrity verification. ### Attack Path 1. An attacker compromises the package publisher account, release pipeline, or another component of the package distribution channel. 2. The attacker publishes a malicious release under the expected `ollama-herd` package name. 3. A user or agent follows the setup instruction and runs `pip install ollama-herd`. 4. Pip resolves and downloads the attacker-controlled release because no version or hash is constrained. 5. Malicious build or installation logic executes, or malicious behavior runs when the user starts `herd` or `herd-node`. 6. The payload operates with the privileges and accessible resources of the user who performed the installation or launched the installed commands. ...[truncated 541 chars]
- Remediation
- ## Remediation Suggestions - Pin the dependency to a reviewed, exact version rather than installing the latest mutable release. - Publish a locked requirements file containing approved cryptographic hashes, and install it with pip's `--require-hashes` option. - Example hardened workflow: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` - Review the selected source release and its build configuration before approving its hashes. - Run the router and node agents under a dedicated, non-privileged account with access limited to required files and network destinations. - Avoid installing the package with root privileges or into the system Python environment. - Use an internally controlled package mirror or vendored, reviewed artifact where stronger supply-chain assurance is required. - Add an upgrade process that requires explicit review, integrity verification, and testing before changing the pinned version.