T08 · Insecure Dependencies
Warning
- Location
- scripts/transcribe.py:17
- Finding
- Unpinned Remote Model Dependency Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/transcribe.py`, lines 17–22 **Vulnerability Type**: Unverified and unpinned third-party model artifact **Risk Level**: Medium ### Vulnerable Code ```python from faster_whisper import WhisperModel print("首次加载模型中...") _cached_model = WhisperModel( "base", device="auto", compute_type="int8" ) ``` ### Technical Analysis The symbolic model identifier `"base"` is passed directly to `WhisperModel`. When the model is not already available locally, `faster-whisper` may resolve and download the corresponding model artifacts from an external model repository. The code does not specify an immutable model revision, verify a cryptographic checksum or signature, or require a prevalidated local model path. Consequently, the exact artifact loaded during first use depends on external repository resolution and the state of the upstream supply chain at that time. This weakens reproducibility and artifact integrity. Although `SKILL.md` discloses that the model is downloaded on first use, the claim that operation is fully offline is only accurate after all required artifacts have been acquired and cached. ### Attack Path 1. A user invokes `scripts/transcribe.py` for a supported audio file. 2. `transcribe()` calls `get_model()`. 3. `get_model()` initializes `WhisperModel("base")`. 4. If the model is absent from the local cache, the dependency resolves and retrieves model artifacts from its configured external source. 5. An attacker who has compromised the upstream repository, distribution channel, dependency resolution process, or network trust boundary supplies an altered artifact. 6. The unverified artifact is cached and loaded by the local transcription process. 7. The altered component may compromise transcription integrity or otherwise affect processing according to the capabilities and loading behavior of the installed dependency. ### Impact Assessment No direct privilege escalation is demon ...[truncated 588 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `faster-whisper` and all transitive dependencies to reviewed, exact versions using a lock file with package hashes. 2. Pin the model to an immutable upstream revision rather than relying only on the mutable symbolic identifier `"base"`. 3. Record an approved cryptographic checksum for every required model artifact and verify it before loading. 4. Prefer a reviewed local model directory: ```python model_path = "/opt/openclaw/models/faster-whisper-base" _cached_model = WhisperModel( model_path, device="auto", compute_type="int8", local_files_only=True, ) ``` 5. Provision the verified model separately during installation and configure runtime operation to fail closed if it is missing, rather than downloading it automatically. 6. Store model artifacts in a directory that is not writable by untrusted users and apply least-privilege filesystem permissions. 7. Document that the first-run setup requires network access if automatic acquisition remains enabled; do not describe that setup phase as fully offline. ]]>