T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:143
- Finding
- Unpinned Third-Party Dependencies Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 143 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Install dependencies: `pip install tweepy google-auth` ``` The executable script also imports an undeclared dependency at `scripts/auto-post.py`, line 11: ```python from dotenv import load_dotenv ``` ### Technical Analysis The installation instructions direct users to install `tweepy` and `google-auth` without exact versions, cryptographic hashes, or a reviewed lockfile. Consequently, package resolution depends on mutable package-index state at installation time. The installed versions and their transitive dependency graphs may differ between installations. If the configured package index, a package release, maintainer account, or transitive dependency is compromised, installation may introduce attacker-controlled code. Python packages can execute code during build or installation, while imported packages execute code with the privileges of the Python process at runtime. In addition, `scripts/auto-post.py` imports `python-dotenv`, but the documented installation command does not install or pin that package. This omission creates unreliable deployment behavior and may encourage users to install an arbitrary package ad hoc. No evidence demonstrates that the currently named packages are malicious. The confirmed issue is the absence of dependency integrity and reproducibility controls. ### Attack Path 1. A user follows the setup instructions and executes `pip install tweepy google-auth`. 2. `pip` resolves the latest available package versions and transitive dependencies from the user's configured package index. 3. An attacker compromises a relevant package release, maintainer account, dependency, or package-index route. 4. The compromised package executes malicious build or installation logic, or is imported during subsequent ...[truncated 768 chars]
- Remediation
- ## Remediation Suggestions 1. Create a reviewed dependency manifest containing every direct dependency, including `python-dotenv`. 2. Pin all direct and transitive dependencies to exact versions using a lockfile generated by a tool such as `pip-tools`, Poetry, or uv. 3. Record cryptographic hashes and enforce them during installation, for example with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Install dependencies in a dedicated virtual environment under a non-privileged account. 5. Review dependency changes before updating the lockfile and use automated vulnerability and provenance scanning. 6. Configure trusted package indexes explicitly and avoid unreviewed mirrors or extra indexes. 7. Remove unused dependencies from the instructions until the corresponding platform integrations are implemented.