T08 · Insecure Dependencies
Error
- Location
scripts/install_deps.py:78- Finding
Unpinned Remote Dependencies Permit Supply-Chain Code Execution
- Content
View full analysis
dict: """Install Python packages.""" result = {"tool": "python_packages", "success": False, "packages": {}} for pkg in packages: try: subprocess.run( [sys.executable, "-m", "pip", "install", pkg], check=True, capture_output=True, timeout=120, ) result["packages"][pkg] = "installed" except subprocess.CalledProcessError as e: result["packages"][pkg] = f"installation failed: {e.stderr.decode()[:200]}" except Exception as e: result["packages"][pkg] = f"error: {e}" ``` ```python try: # Clone ComfyUI subprocess.run( ["git", "clone", "https://github.com/comfyanonymous/ComfyUI.git", str(target_path)], check=True, timeout=300, ) # Install dependencies requirements = target_path / "requirements.txt" if requirements.exists(): subprocess.run( [sys.executable, "-m", "pip", "install", "-r", str(requirements)], check=True, timeout=600, ) ``` ### Technical Analysis The installer obtains Python packages by name without version constraints or package hashes. It also clones the current default branch of ComfyUI without selecting or verifying a reviewed commit or signed release. It subsequently installs dependencies from the remotely retrieved `requirements.txt`. Consequently, the effective code installed by the Skill can change after the Skill itself has been reviewed. A compromised package release, package index, GitHub repository, maintainer account, or mutable dependency declaration could introduce arbitrary installation-time or runtime code. The module documentation states that user confirm ...[truncated 1552 chars]- Remediation
View remediation
``` 4. Verify the checked-out commit and, where available, validate signed tags or release artifacts. 5. Review and lock ComfyUI's transitive dependencies rather than directly installing a mutable remote `requirements.txt`. 6. Install Python packages inside an isolated virtual environment with no administrative privileges. 7. Add an actual interactive confirmation prompt that displays the exact source, version, destination, and commands before making changes. 8. Require a separate explicit flag such as `--yes` for non-interactive operation. 9. Avoid invoking package managers through `sudo` automatically. Instead, print the command and require the user to perform privileged installation separately. 10. Record dependency provenance and verify downloaded artifacts against expected checksums. ]]>