T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Installation of a Security-Sensitive Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, lines 6 and 12 **Vulnerability Type**: Unpinned third-party dependency from mutable sources **Risk Level**: Medium ### Vulnerable Code ```text metadata: {"openclaw":{"emoji":"📂","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}} ``` ```shell brew install porteden/tap/porteden # or go install github.com/porteden/cli/cmd/porteden@latest ``` ### Technical Analysis The skill instructs users or agents to install the `porteden` CLI through a custom Homebrew tap or by using Go's mutable `@latest` version selector. It does not pin an immutable release or commit and provides no checksum, signature, provenance, or integrity-verification procedure. Because the installed CLI processes `PE_API_KEY`, can read credentials from the system keyring, and receives authorized Google Drive access, compromise or unexpected modification of the upstream repository, release pipeline, module, or Homebrew tap would have security consequences beyond an ordinary utility dependency. The use of `@latest` means that the installed artifact can change after this skill has been reviewed. The custom Homebrew source similarly relies on upstream package integrity without a verification step. The audit found no evidence that the currently referenced package is malicious; the vulnerability is the unsafe and mutable dependency acquisition process. ### Attack Path 1. An attacker compromises the upstream Go repository, module release process, custom Homebrew tap, or associated distributio ...[truncated 1431 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a specific, reviewed semantic version or immutable commit digest, for example: ```shell go install github.com/porteden/cli/cmd/porteden@vX.Y.Z ``` 2. Pin the Homebrew formula to an approved release where practical, and document the expected formula source and version. 3. Publish trusted SHA-256 checksums or cryptographic signatures through a channel independent of the downloadable artifact. 4. Verify checksums, signatures, and release provenance before installation. 5. Prefer reproducible builds and signed release artifacts from an official, verifiable distribution source. 6. Define an update-review process so dependency upgrades are explicitly audited rather than automatically resolved. 7. Document the exact OAuth scopes and token restrictions required, and grant only the minimum Drive permissions needed. 8. Avoid exposing `PE_API_KEY` to unrelated child processes and use a protected system keyring where possible. 9. Instruct users to review `accessInfo` and authentication warnings before performing sensitive operations. 10. Retain confirmation requirements for sharing and deletion operations.