T08 · Insecure Dependencies
Error
- Location
- SKILL.md:14
- Finding
- Unpinned External Package Executes with MinIO Credentials and Administrative Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-16, 60-75`; `references/setup-guide.md:7-10, 78-84` **Vulnerability Type**: Unpinned executable dependency and mutable supply-chain source **Risk Level**: High ### Vulnerable Code `SKILL.md:14-16`: ```yaml installer: kind: uv package: minio-aiops ``` `SKILL.md:60-75`: ```bash ## Quick Install uv tool install minio-aiops minio-aiops init # interactive wizard: endpoint + access key + encrypted secret key minio-aiops doctor ``` ```bash openclaw plugins install clawhub:@zw008/minio-aiops openclaw skills info minio-aiops # expect: Visible to model: yes ``` ```text Needs `uvx` on `PATH`: the MCP server is fetched with uv, pinned to this release. ``` `references/setup-guide.md:7-10`: ```bash ## 1. Install uv tool install minio-aiops # or: pipx install minio-aiops ``` `references/setup-guide.md:78-84`: ```json { "mcpServers": { "minio-aiops": { "command": "uvx", "args": ["--from", "minio-aiops", "minio-aiops-mcp"], "env": { "MINIO_AIOPS_MASTER_PASSWORD": "your-master-password" } } } } ``` ### Technical Analysis The audited project contains documentation rather than the implementation of the `minio-aiops` executable. Its effective behavior therefore depends on a package retrieved from an external package registry at installation or MCP startup time. The installation commands and MCP configuration identify `minio-aiops` without an exact version, hash, signature, or immutable artifact reference. Consequently, the code executed by users can change after this Skill has been reviewed. This contradicts the statement in `SKILL.md:75` that the package is “pinned to this release.” The risk is elevated because the MCP process is explicitly supplied with `MINIO_AIOPS_MASTER_PASSWORD`. After unlocking the local encrypted secret store, the package can access the configured MinIO secret keys and communicate with MinIO using the permissions granted ...[truncated 2643 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the package to a reviewed exact version in every installation and execution path: ```yaml installer: kind: uv package: minio-aiops==X.Y.Z ``` ```bash uv tool install "minio-aiops==X.Y.Z" ``` ```json { "command": "uvx", "args": [ "--from", "minio-aiops==X.Y.Z", "minio-aiops-mcp" ] } ``` 2. Require cryptographic integrity verification. Use a lockfile with hashes, hash-pinned requirements, signed release artifacts, or an equivalent trusted verification mechanism. 3. Ensure the OpenClaw plugin, Skill metadata, documentation, and MCP configuration all resolve to the same audited package version. Add an automated release check that fails if any unversioned package reference remains. 4. Prefer an immutable internal artifact repository or vendored, reviewed implementation rather than resolving the latest public package during runtime. 5. Separate installation from runtime. Preinstall and verify the package in a controlled build stage, then run the fixed executable without allowing `uvx` to retrieve a new package when the MCP server starts. 6. Use a dedicated read-only MinIO access key by default. Grant write or administrative permissions only for explicitly approved operations and revoke them after use. 7. Limit access to `MINIO_AIOPS_MASTER_PASSWORD`. Supply it through a protected secret manager where possible, avoid broad process inheritance, and never place a real password directly in committed MCP configuration. 8. Run the MCP server in a sandbox with restricted filesystem access, outbound network access limited to approved MinIO endpoints, and no unnecessary local privileges. 9. Correct or remove the statement that the package is “pinned to this release” unless an enforceable version and integrity constraint is actually present. ]]>