T08 · Insecure Dependencies
Warning
- Location
SKILL.md:18- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
/dev/null pip3 install faster-whisper 2>&1 | tail -3 ``` ### Technical Analysis The Skill directs users or agents to install `yt-dlp`, `ffmpeg`, and `faster-whisper` without pinning reviewed versions, verifying package hashes, or using a dependency lock file. In particular, `pip3 install faster-whisper` may execute package-controlled installation or build logic with the privileges of the invoking user. The commands rely on the current state of external package repositories and their transitive dependency resolution. Consequently, the code installed during a future invocation may differ from the code that existed when the Skill was reviewed. This does not prove that any named package is malicious. The vulnerability is the absence of controls that would constrain dependency identity and content to reviewed artifacts. ### Attack Path 1. An attacker compromises an upstream package, release account, package repository, distribution channel, or transitive dependency. 2. A user or agent follows the Skill instructions and runs the unpinned Homebrew or pip installation command. 3. The package manager resolves the dependency to the attacker-influenced version. 4. Package installation or subsequent execution runs attacker-controlled code. 5. The code executes with the permissions of the account that invoked the installation or tool. ### Impact Assessment Su ...[truncated 522 chars]- Remediation
View remediation
/dev/null` and `tail -3` can hide warnings relevant to dependency integrity. ]]>