T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:19
- Finding
- External Dependency Installed Without Cryptographic Artifact Verification## Vulnerability Details **File Location**: `SKILL.md:19`, `SKILL.md:69-72`, `SKILL.md:113-126`; `manifest.json:73` **Vulnerability Type**: Third-party dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code `SKILL.md:19`: ```yaml install: "pip install sinkron==1.0.2" ``` `SKILL.md:69-72`: ```bash # Download wheel/tarball without installing, then inspect contents pip download sinkron==X.Y.Z --no-deps -d /tmp/sinkron-inspect ls /tmp/sinkron-inspect/ # Unzip the .whl (it's a zip) and review .py source files for # unexpected network callbacks, obfuscated code, or telemetry ``` `SKILL.md:113-126`: ```bash pip index versions sinkron ``` ```bash # Preferred (pinned version) pip install sinkron==X.Y.Z # Alternative via uv (also pin version) uv tool install sinkron==X.Y.Z ``` `manifest.json:73`: ```json "installation": ["pip install sinkron==1.0.2", "uv tool install sinkron==1.0.2"], ``` ### Technical Analysis The reviewed project contains only documentation and a manifest; it does not include the source code of the `sinkron` CLI or Python SDK. Consequently, the external package's installation behavior, network destinations, credential storage, and handling of email content cannot be verified from this artifact. Pinning the dependency to version `1.0.2` limits unintended upgrades, but it does not cryptographically authenticate the package downloaded from the package index. The project provides no approved SHA-256 digest, hash-locked requirements file, vendored source, signed artifact, or reproducible-build verification. The recommended source inspection and isolated testing are advisory and are not enforced by the installation commands. Package installation and subsequent imports execute code controlled by the external distribution. Once `SINKRON_TOKEN` is exposed to that process, the package can access the credential and any inbox data returned through the API. This i ...[truncated 2150 chars]
- Remediation
- ## Remediation Suggestions 1. Provide a reviewed, hash-locked dependency manifest containing the exact package version and approved SHA-256 digest, and require installation with `pip install --require-hashes -r requirements.txt`. 2. Alternatively, bundle the audited dependency source or a verified wheel with the Skill so the reviewed implementation corresponds exactly to the executed artifact. 3. Publish and verify signed release artifacts, and document the expected package publisher, artifact filename, digest, and signing identity. 4. Replace placeholder installation examples such as `sinkron==X.Y.Z` with a single reviewed version and its matching integrity metadata. 5. Perform dependency verification before exposing `SINKRON_TOKEN`; installation and initial validation should occur in an environment where the credential is absent. 6. Run the package in a restricted container or dedicated account with minimal filesystem access, a minimal environment, and network access limited to documented Sinkron API origins. 7. Document the exact API origin, TLS requirements, redirect policy, and local token-storage path so operators can enforce outbound allowlists and verify credential handling. 8. Avoid passing secrets through command-line arguments where they may appear in process listings or logs. Prefer direct environment injection, standard input, or an operating-system secret store with restrictive permissions. 9. Audit the external package's installation hooks, HTTP client behavior, telemetry, configuration permissions, and message-deletion authorization before production deployment.