T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party Python Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-25 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml "install": [ { "id": "requests", "kind": "pip", "package": "requests", "label": "安装依赖：pip3 install requests", }, { "id": "jieba", "kind": "pip", "package": "jieba", "label": "安装依赖：pip3 install jieba", }, ], ``` ### Technical Analysis The skill declares the `requests` and `jieba` packages as installation dependencies without exact version constraints or cryptographic integrity hashes. The installation process can therefore resolve different package artifacts over time, depending on the current state of the configured Python package index and dependency graph. No malicious package or active compromise was identified in the audited artifact. However, the dependency configuration is not reproducible and does not ensure that installation retrieves the same reviewed artifacts on every system. If an upstream package, transitive dependency, package index, or dependency-resolution process is compromised, attacker-controlled package installation code could be executed. ### Attack Path 1. A user or automated skill manager installs the skill dependencies. 2. The package manager resolves `requests` and `jieba` without exact version restrictions. 3. An upstream release, transitive dependency, or configured package source has been compromised or replaced with a malicious artifact. 4. The package manager downloads the attacker-controlled artifact. 5. Malicious build or installation logic executes with the privileges of the account performing the installation. 6. Any installed malicious runtime code may subsequently execute when the dependency is imported or used. This attack path requires a compromise or malicious substitution in the external dependency supply chain; the audited file does not itself contain a malici ...[truncated 608 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin each direct dependency to an exact, reviewed version, for example: ```text requests==<reviewed-version> jieba==<reviewed-version> ``` 2. Generate and commit a lock file containing all direct and transitive dependencies. 3. Record cryptographic hashes for approved distributions and enforce hash verification during installation, such as with `pip --require-hashes`. 4. Restrict package retrieval to an approved Python package index or an internally controlled package mirror. 5. Review and update pinned dependencies through a controlled process that includes vulnerability scanning, package provenance verification, and regression testing. 6. Perform dependency installation under a non-privileged account in an isolated virtual environment or container. 7. Avoid running package installation as `root` or another privileged system account. ]]>