T08 · Insecure Dependencies
Error
- Location
- SKILL.md:57
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:57-71`; related MCP configuration at `references/setup-guide.md:76-81` **Vulnerability Type**: Unpinned dependency retrieval and execution **Risk Level**: High ### Vulnerable Code ```markdown ```bash uv tool install xcpng-aiops xcpng-aiops init # interactive wizard: XO URL + encrypted token xcpng-aiops doctor # XO reachability + token validity + pool count ``` Or as an OpenClaw plugin, which installs this skill and its MCP server together: ```bash openclaw plugins install clawhub:@zw008/xcpng-aiops openclaw skills info xcpng-aiops # expect: Visible to model: yes ``` Needs `uvx` on `PATH`: the MCP server is fetched with uv, pinned to this release. ``` The related MCP configuration also invokes the package without an explicit version: ```json { "mcpServers": { "xcpng-aiops": { "command": "uvx", "args": ["--from", "xcpng-aiops", "xcpng-aiops-mcp"], "env": { "XCPNG_AIOPS_MASTER_PASSWORD": "your-master-password" } } } } ``` ### Technical Analysis The documented installation and MCP launch commands retrieve executable third-party packages from external package or plugin registries without specifying an immutable version, artifact digest, or verified signature. Although `SKILL.md` states that the MCP server is “pinned to this release,” the documented `uvx --from xcpng-aiops` invocation contains no visible version constraint. Consequently, the effective code executed by a future installation can differ from the code that was reviewed during this audit. This creates a software supply-chain trust boundary. A compromised publisher account, registry, package namespace, plugin namespace, or future malicious package release could replace the expected implementation with attacker-controlled code. Because package installation and MCP startup execute code locally, compromise would not be limited to Xen Orchestra API behavior. The reviewed project contains ...[truncated 1717 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every package and plugin command to an exact reviewed version: ```bash uv tool install "xcpng-aiops==<reviewed-version>" uvx --from "xcpng-aiops==<reviewed-version>" xcpng-aiops-mcp ``` 2. Use an exact immutable ClawHub release identifier rather than a mutable package name or latest tag. 3. Publish and verify cryptographic hashes or signed provenance for all distributed artifacts. 4. Use a lockfile with fully resolved transitive dependency versions and integrity hashes. 5. Ensure documentation and metadata use the same package version as the reviewed Skill release. 6. Run the MCP server in a restricted environment with: - A dedicated unprivileged operating-system account. - Minimal filesystem access. - A restricted environment-variable set. - Network access limited to the intended Xen Orchestra endpoint and required package infrastructure. 7. Add automated checks that reject unpinned dependency and plugin commands in release documentation. 8. Provide the executable package source or a reproducible-build reference so the implementation can be audited alongside the Skill instructions. ]]>