T08 · Insecure Dependencies
Error
- Location
SKILL.md:30- Finding
Unpinned Remote Dependency Is Installed and Executed from a Mutable GitHub Branch
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 30-38
Vulnerability Type: Unpinned remote dependency and supply-chain code execution
Risk Level: HighVulnerable Code
bash ## Setup ```bash pip install https://github.com/Panniantong/agent-reach/archive/main.zip agent-reach install --env=auto agent-reach doctorinstallauto-detects your environment and installs core dependencies (Node.js, mcporter, xreach CLI, gh CLI, yt-dlp, feedparser).text ### Technical Analysis The setup instructions install a Python package directly from the mutable `main` branch of a user-controlled GitHub repository. No immutable commit, signed release, version constraint, or cryptographic hash is specified. Consequently, the code retrieved during installation may differ from the code that was reviewed. Installing a Python source archive can execute attacker-controlled packaging and build logic. The subsequently installed `agent-reach` command is then explicitly invoked with `install --env=auto`, which is described as installing several additional tools. This expands the effective supply chain beyond the reviewed skill and delegates package installation and environment modification to remotely maintained code. Although downloading dependencies is relevant to the declared installer functionality, using an unpinned mutable branch and permitting it to install further components exceeds the minimum safe privilege needed. A fixed, verified release would provide the same functionality with substantially less supply-chain risk. ### Attack Path 1. An attacker compromises the referenced GitHub account, repository, dependency chain, or maintainer credentials. 2. The attacker modifies the repository's `main` branch or its packaging configuration. 3. A user or agent follows the skill instructions and runs the `pip install` command. 4. The malicious package executes during installation or when the installed `agent-re ...[truncated 827 chars]- Remediation
View remediation
Remediation Suggestions
- Publish and install a specific, reviewed package release from a trusted package registry.
- If installation from GitHub is unavoidable, pin the URL to an immutable full commit hash rather than
main. - Require hash verification, such as
pip install --require-hashes, against a separately distributed trusted digest. - Verify release signatures or attestations and document the expected publisher identity.
- Audit and pin every dependency installed by
agent-reach install; do not dynamically install unspecified latest versions. - Present the complete installation plan and obtain explicit user approval before adding Node.js, global npm tools, CLIs, services, or other system components.
- Run installation in an isolated virtual environment or container with restricted filesystem and network access.
- Avoid elevated execution and fail safely if the installer attempts to invoke
sudoor modify system-wide locations.