T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Third-Party Python Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 12-20 **Vulnerability Type**: Unpinned package installation from a third-party registry **Risk Level**: Medium ```yaml "install": [ { "id": "requests", "kind": "pip", "package": "requests", "label": "安装依赖：pip3 install requests", }, ], ``` ### Technical Analysis The skill metadata directs the host to install the `requests` package without specifying an exact version, integrity hash, lockfile, or trusted artifact source. Consequently, the package manager can resolve a different package release and different transitive dependencies depending on when installation occurs. Although `requests` is a legitimate package and the reviewed file contains no evidence that it is currently malicious, the unconstrained installation process creates avoidable supply-chain exposure. If a resolved package or transitive dependency is compromised, malicious code could execute during installation or when imported. The project contains no Python implementation that uses `requests`, so the declared dependency also appears unnecessary based on the audited contents. ### Attack Path 1. A user or automated skill host installs the skill and processes its installation metadata. 2. The host runs the equivalent of `pip3 install requests` against its configured package registry. 3. The package manager resolves the current package version and its transitive dependencies without validating them against a lockfile or expected hashes. 4. If the registry, selected release, dependency-resolution path, or host package-index configuration has been compromised, attacker-controlled package content is downloaded. 5. Malicious package behavior may execute during installation or later when the package is imported by skill functionality. This exploitation path is conditional on compromise or manipulation of the package supply chain; the audited project does not ...[truncated 678 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `requests` installation declaration unless implemented skill code demonstrably requires it. 2. If required, pin the package to a specifically reviewed version using an exact constraint such as `requests==X.Y.Z`. 3. Generate and retain a dependency lockfile that fixes all transitive dependency versions. 4. Require cryptographic hashes for downloaded distributions, for example through a hash-locked requirements file and pip's `--require-hashes` option. 5. Obtain dependencies only from an explicitly configured trusted package index and avoid fallback to untrusted or user-controlled registries. 6. Review dependency provenance and vulnerability advisories before updating pinned versions. 7. Install and run the skill in an isolated, least-privilege virtual environment or container rather than a privileged or shared system Python environment.