T08 · Insecure Dependencies
Error
- Location
scripts/install.sh:12- Finding
Unpinned Third-Party Dependencies and Externally Supplied Runtime Code
- Content
View full analysis
/dev/null || pip install -q --break-system-packages pyyaml requests flask prometheus-client 2>/dev/null || echo "Dependency installation skipped" ``` The startup script also installs dependencies dynamically: ```bash python3 -c "import yaml" 2>/dev/null || { echo "📦 Installing dependencies..." pip install -q pyyaml requests flask } ``` The documentation instructs users to retrieve an unpinned external runtime: ```bash pip install edict-openclaw git clone https://github.com/cft0808/edict.git cd edict pip install -e . ``` ### Technical Analysis The project does not include the Python `edict` implementation imported by its startup script and tests. Its effective runtime therefore depends on code obtained separately from a package registry, a mutable Git repository, or a pre-existing installation. Neither the package installations nor the Git installation are pinned to reviewed, immutable artifacts. The dependency declarations use only lower bounds, such as `pyyaml>=5.4`, and the shell scripts install packages without exact versions or cryptographic hashes. Consequently, future package releases or changes to the repository's default branch can alter the code executed after this artifact has been reviewed. The installer also falls back to `pip --break-system-packages`. This can alter the host's system-managed Python environment rather than containing dependencies in a dedicated virtual environment, increasing the scope of a compromised or incompatible dependency. Because the actual server implementation is absent, its runtime ...[truncated 1446 chars]- Remediation
View remediation