T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 18–22 **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```json { "id": "pip-mlx-whisper", "kind": "exec", "command": "pip3", "args": ["install", "mlx-whisper"], "label": "Install mlx-whisper (Apple Silicon)", } ``` The same unpinned installation command is repeated at `SKILL.md:45`: ```bash pip3 install mlx-whisper ``` ### Technical Analysis The Skill directs `pip3` to install `mlx-whisper` without specifying a reviewed version, locking its transitive dependencies, or validating package integrity with cryptographic hashes. Consequently, installation resolves whatever package versions the configured Python package index serves at execution time. This makes the installed code mutable after the Skill has been reviewed. If the upstream package, one of its dependencies, its maintainer account, or the package-index delivery path is compromised, a malicious release could execute code during installation or later when the package is imported for transcription. The global or user-level `pip3` invocation also lacks explicit environment isolation, increasing the possibility of dependency conflicts and expanding the effect on the user's Python environment. ### Attack Path 1. An attacker compromises the `mlx-whisper` distribution, a transitive dependency, or an associated package-maintainer account. 2. The attacker publishes a malicious version that remains compatible with the unrestricted package requirement. 3. A user installs the Skill or follows its setup instructions. 4. The command `pip3 install mlx-whisper` resolves and downloads the malicious release because no approved version or hash is enforced. 5. Malicious package code executes during installation or when OpenClaw invokes the transcription workflow. 6. The payload gains the permissions of the account runni ...[truncated 763 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `mlx-whisper` to a specific version that has been reviewed, for example: ```bash python3 -m pip install "mlx-whisper==<reviewed-version>" ``` 2. Generate a lock file containing exact versions for all transitive dependencies. 3. Require cryptographic hashes during installation, such as with a hash-pinned requirements file and: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Install the package in a dedicated virtual environment rather than the user's shared Python environment. 5. Use a trusted package index and document the expected package publisher and artifact hashes. 6. Add automated dependency monitoring and repeat the security review before updating any pinned version or hash. 7. Include the referenced `bin/mlx-whisper-transcribe.sh` in the distributed project so its input handling, model retrieval, command construction, and runtime behavior can be audited before release.