T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned third-party dependencies permit uncontrolled package upgrades## Vulnerability Details **File Location**: `requirements.txt:1`; `SKILL.md:8-15` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1`: ```text ai-agent-marketplace>=0.0.10 ``` `SKILL.md:8-15`: ```yaml dependencies: npm: - "@aiagenta2z/onekey-gateway" python: - "ai-agent-marketplace" installation: npm: npm -g install @aiagenta2z/onekey-gateway python: pip install ai-agent-marketplace ``` ### Technical Analysis The Python requirement uses an open-ended lower bound, while the npm dependency has no version constraint. Consequently, a fresh installation can resolve to any future compatible Python release and the current npm release without repository-controlled review. The skill documentation instructs users or agents to install these dependencies before executing the scripts. Every Python script imports `OneKeyAgentRouter` from `ai_agent_marketplace`, so package initialization code executes in the local Python process. The npm package is also installed globally in the documented command, increasing the consequences of a compromised release because package lifecycle scripts may run during installation and the resulting executable is exposed system-wide. No malicious dependency payload was present in the audited project itself. The vulnerability is the lack of reproducible dependency resolution, which creates an avoidable supply-chain attack path if a package publisher account, registry package, or future release is compromised. ### Attack Path 1. An attacker compromises a dependency publisher or causes a malicious future version of `ai-agent-marketplace` or `@aiagenta2z/onekey-gateway` to be published. 2. A user or automated agent follows `SKILL.md` and performs a fresh installation. 3. The unconstrained npm specification or Python `>=` range resolves to the attacker-controlled release. 4. Mal ...[truncated 801 chars]
- Remediation
- ## Remediation Suggestions - Pin Python dependencies to reviewed exact versions, for example `ai-agent-marketplace==X.Y.Z`. - Pin the npm package to an exact reviewed version rather than installing the latest release. - Commit lock files with integrity hashes where the installation workflow supports them. - For Python, use a hash-locked requirements file generated by a dependency-locking tool and install with `pip --require-hashes`. - Avoid global npm installation. Use a project-local dependency with a committed lock file and invoke the locally resolved binary. - Disable or tightly control npm lifecycle scripts where operationally possible. - Use an internal package mirror or allowlist and add automated dependency vulnerability and provenance checks. - Review and deliberately update dependency pins instead of accepting future releases automatically.