T08 · Insecure Dependencies
Warning
- Location
- scripts/bitstamp.py:39
- Finding
- Unpinned privileged CCXT dependency creates supply-chain risk<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bitstamp.py:39-44` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```python try: import ccxt except ImportError: print("ERROR: ccxt not installed. Run:") print(f" source {SKILL_DIR}/.venv/bin/activate && pip install ccxt") sys.exit(1) ``` ### Technical Analysis The installation guidance invokes `pip install ccxt` without a pinned version, lock file, or package hash. The effective dependency can therefore change after the Skill has been reviewed. CCXT is security-sensitive in this project because it receives the Bitstamp API key and secret and implements authenticated account and order operations: ```python return ccxt.bitstamp({ "apiKey": api_key, "secret": api_secret, "enableRateLimit": True, }) ``` An upstream compromise, malicious package-index response, or incompatible future release could execute arbitrary Python code under the invoking user's account. It could also intercept exchange credentials or alter authenticated trading requests. The audit found no evidence that the current project intentionally installs a malicious package. The issue is the absence of controls ensuring that users install the same reviewed dependency version. ### Attack Path 1. CCXT is absent from the local environment. 2. The application displays an instruction to execute `pip install ccxt`. 3. The user installs whatever release the configured package index currently resolves. 4. A compromised or unexpectedly modified CCXT package is imported by `scripts/bitstamp.py`. 5. The package executes with the permissions of the invoking user. 6. For authenticated commands, it receives the Bitstamp API key and secret and can observe or manipulate account and trading requests. ### Impact Assessment A compromised dependency could: - Read the Bitstamp API key and secret available to the process. - Submit, cancel, or modify trades within th ...[truncated 428 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin CCXT to a reviewed exact version, for example through a locked requirements file. 2. Require package hashes, such as with `pip install --require-hashes -r requirements.txt`. 3. Commit an auditable dependency lock file and review dependency changes before updating it. 4. Document use of the official Python package index or an organization-controlled package mirror. 5. Add automated dependency vulnerability and provenance scanning. 6. Continue requiring Bitstamp API keys without withdrawal permission and with IP allowlisting. 7. Consider running the CLI in an isolated virtual environment with minimal filesystem permissions. ]]>