T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Mutable Third-Party CLI Installation Without Version Pinning## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 12 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"📧","requires":{"bins":["porteden"],"env":["PE_API_KEY"]},"primaryEnv":"PE_API_KEY","install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}} ``` ```markdown If `porteden` is not installed: `brew install porteden/tap/porteden` (or `go install github.com/porteden/cli/cmd/porteden@latest`). ``` ### Technical Analysis The Skill instructs users or agents to install a third-party executable using the mutable Go version selector `@latest`. The Homebrew instruction also installs the version currently exposed by an external tap without identifying a reviewed release or artifact checksum. Because the executable's source is not included in this project, its behavior could not be audited. A future upstream release can differ from the version that existed when this Skill was reviewed. Installing `@latest` therefore permits externally controlled code changes to enter the execution environment without any corresponding modification to the audited Skill. This is particularly sensitive because the installed CLI is subsequently expected to process `PE_API_KEY`, interact with the system keyring, read private email content, and perform mailbox mutations. No evidence establishes that the current upstream package is malicious; the vulnerability is the absence of dependency immutability and artifact verification. ### Attack Path 1. An attacker compromises the upstream repository, release process, Go module source, or Homebrew tap used to distribute `porteden`. 2. The attacker publishes a modified release that is selected by `@latest` or up ...[truncated 1227 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a specifically reviewed semantic version or immutable commit identifier, for example: ```text go install github.com/porteden/cli/cmd/porteden@vX.Y.Z ``` 2. Pin the Homebrew installation to a reviewed formula and version where the distribution mechanism permits it. 3. Document expected module checksums, release signatures, or artifact hashes and verify them before installation. 4. Use reproducible builds and retain a software bill of materials for the reviewed CLI release. 5. Configure automated dependency monitoring so version updates undergo review rather than being adopted implicitly. 6. Restrict `PE_API_KEY` and provider authorization to the narrowest mailbox scopes required by the requested operation. 7. Run the CLI in a constrained environment with minimal filesystem, environment-variable, and network access. 8. Document the external network endpoints required by the CLI and deny unrelated outbound destinations where feasible.