T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Mutable and Unverified Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1`; `SKILL.md:9-15`, `SKILL.md:22-31`, and `SKILL.md:261-276` **Vulnerability Type**: Supply-chain exposure caused by non-reproducible dependency installation **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1`: ```text ai-agent-marketplace>=0.0.10 ``` `SKILL.md:9-15`: ```yaml dependencies: npm: - "@aiagenta2z/onekey-gateway" python: - "ai-agent-marketplace" installation: npm: npm -g install @aiagenta2z/onekey-gateway python: pip install ai-agent-marketplace ``` `SKILL.md:22-31`: ```markdown Install the required Python package before running any scripts. ```bash pip install ai-agent-marketplace ``` Alternatively, install dependencies from the requirements file: ```bash pip install -r requirements.txt ``` ``` ### Technical Analysis The Skill requires executable third-party Python and npm packages but does not pin them to exact, reviewed versions or provide integrity hashes. The Python constraint accepts version `0.0.10` and every later release. The npm commands similarly resolve the current registry release, and one documented command installs the package globally. Consequently, installation is not reproducible: code installed after this audit may differ from code previously reviewed. Package installation and subsequent imports can execute code outside this repository. This creates a supply-chain attack surface if a publisher account, package release, transitive dependency, or registry delivery path is compromised. The audit did not establish that either named package is currently malicious. The confirmed issue is the unsafe dependency policy that permits future unreviewed code to enter the execution path. ### Attack Path 1. An attacker compromises a dependency publisher, transitive dependency, or package release process. 2. The attacker publishes a malicious version that still satisfies `ai-agent-marketplace>=0.0.10`, or replaces the npm package ver ...[truncated 1016 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin Python dependencies to exact reviewed versions, for example: ```text ai-agent-marketplace==<reviewed-version> --hash=sha256:<verified-hash> ``` 2. Generate dependencies with hashes using a reproducible workflow such as `pip-compile --generate-hashes`, and install with `pip install --require-hashes`. 3. Commit an npm lock file and use `npm ci` rather than resolving the latest package dynamically. 4. Pin the npm dependency to an exact reviewed version rather than using an unconstrained installation command. 5. Avoid global npm installation. Install into a project-local, isolated environment with least privilege. 6. Disable package lifecycle scripts where compatible, and review all required install hooks before enabling them. 7. Audit transitive dependencies and verify package ownership, provenance, signatures, and registry source. 8. Run dependency installation and Skill execution in a sandbox with restricted filesystem, environment-variable, and network access. 9. Establish a controlled update process in which new versions are reviewed and tested before lock files and hashes are changed. ]]>