T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party CLI Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 7 and 14 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🤖","homepage":"https://porteden.com","requires":{"bins":["porteden"]},"primaryEnv":"PE_API_KEY","envVars":[{"name":"PE_API_KEY","required":false,"description":"API key; if unset, credentials are read from the system keyring via `porteden auth login`"},{"name":"PE_SHEET_ID","required":false,"description":"Target spreadsheet ID; if unset, the skill finds the sheet by name (see body)"}],"install":[{"id":"brew","kind":"brew","formula":"porteden/tap/porteden","bins":["porteden"],"label":"Install porteden (brew)"},{"id":"go","kind":"go","module":"github.com/porteden/cli/cmd/porteden@latest","bins":["porteden"],"label":"Install porteden (go)"}]}} ``` ```markdown If `porteden` is not installed: `brew install porteden/tap/porteden` (or `go install github.com/porteden/cli/cmd/porteden@latest`). ``` ### Technical Analysis The Go installation source uses the mutable `@latest` version selector. Consequently, the executable installed by a user is not tied to the version that was reviewed during this audit. A future upstream release or compromise of the upstream repository can silently alter the effective behavior of the skill without requiring any change to `SKILL.md`. The alternative Homebrew command also installs from a custom third-party tap without specifying a reviewed version or requiring checksum or signature verification. Although the third-party source is disclosed and appears related to the documented project, the installation instructions do not establish artifact integrity. This is a supply-chain weakness rather than evidence that the currently documented dependency is malicious. ### Attack Path 1. An attacker compromises the upstream Go repository, its release process, or the custom Homebrew tap. 2. The attacker publishes a modified release or formul ...[truncated 1260 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a specifically reviewed semantic version or immutable commit reference, for example: ```bash go install github.com/porteden/cli/cmd/porteden@vX.Y.Z ``` 2. Record and verify trusted release checksums or cryptographic signatures before installation. 3. Pin the Homebrew formula to a reviewed version where supported, and verify the provenance and integrity of the custom tap. 4. Use automated dependency monitoring to identify security advisories, but update the pinned version only after review and testing. 5. Run the CLI under a dedicated, least-privileged account and profile with access only to required spreadsheets. 6. Avoid exposing credentials unnecessarily through process environments, and retain the documented recommendation to use narrowly scoped authentication. 7. Document the exact reviewed CLI version in the skill metadata so users can reproduce the audited installation.