T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Executable Dependency## Vulnerability Details **File Locations**: `SKILL.md:10` and `README.md:16` **Vulnerability Type**: Supply-chain risk caused by a mutable, unpinned dependency **Risk Level**: Medium **Vulnerable code in `SKILL.md:10`:** ```text "install": "go install github.com/typhonius/pidge@latest", ``` **Vulnerable code in `README.md:16`:** ```bash go install github.com/typhonius/pidge@latest ``` ### Technical Analysis The installation instructions use the mutable `@latest` version selector to download and build a third-party executable directly from GitHub. Consequently, the installed source can change after this skill has been reviewed. The project does not pin a reviewed release or document an expected module checksum. An attacker who compromises the upstream repository, its release process, or an account authorized to publish module versions could introduce malicious code into a later release. Users following the documented command would then build and install that code under their local account without any corresponding change to this audited project. This is a supply-chain weakness rather than evidence that the current upstream dependency is malicious. ### Attack Path 1. An attacker compromises the upstream `pidge` repository, release pipeline, or publisher account. 2. The attacker publishes a malicious version that resolves through `@latest`. 3. A user follows the project's installation instructions. 4. Go retrieves, compiles, and installs the mutable malicious release. 5. The installed executable runs with the user's privileges when the skill invokes it. 6. The executable can potentially access the SMS data and gateway configuration available to that user. ### Impact Assessment Successful exploitation would provide code execution with the privileges of the user who installs or invokes `pidge`. Within that user's accessible scope, a compromised executable could read or alter `~/.config/pidge/config.toml`, acc ...[truncated 371 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a reviewed, immutable semantic version: ```bash go install github.com/typhonius/pidge@vX.Y.Z ``` 2. Pin the same version consistently in both `SKILL.md` and `README.md`. 3. Record and verify the expected Go module checksum through a controlled `go.sum` or equivalent integrity-verification procedure. 4. Review dependency source and release provenance before updating the pinned version. 5. Adopt a controlled upgrade process that tests new releases and documents security-relevant changes before modifying the pin. 6. Where supported, require signed releases or verifiable build provenance and distribute hashes for approved binaries. 7. Run the executable with only the filesystem and network permissions required to communicate with the configured SMS gateway.