T08 · Insecure Dependencies
Warning
- Location
- scripts/transcribe.py:35
- Finding
- Automatic Runtime Installation of an Unpinned Third-Party Dependency## Vulnerability Details **File Location**: `scripts/transcribe.py:35-39` **Vulnerability Type**: Unpinned dependency installation during normal execution **Risk Level**: Medium ### Vulnerable Code ```python def install_whisper(): """Attempt to install whisper via pip.""" print("Installing whisper...") try: subprocess.run([sys.executable, '-m', 'pip', 'install', '-U', 'openai-whisper'], check=True, capture_output=True) return True except subprocess.CalledProcessError: return False ``` This function is automatically reached from `scripts/transcribe.py:129-135`: ```python if whisper_type is None: print("Whisper not found. Installing...") if not install_whisper(): print("Failed to install whisper. Please run: pip install openai-whisper") sys.exit(1) whisper_type = 'python' ``` ### Technical Analysis When Whisper is unavailable, an ordinary transcription request automatically invokes pip with `install -U openai-whisper`. Neither the package nor its transitive dependencies are pinned to reviewed versions or verified with cryptographic hashes. The `-U` option further allows dependency versions to change between executions. Python package installation can execute package build and installation logic. Consequently, a compromised package release, transitive dependency, configured package index, or dependency-resolution path could result in arbitrary code execution under the account running the skill. The package name is consistent throughout the project, and the reviewed code does not specify a suspicious package repository. Therefore, this is an unsafe supply-chain design rather than evidence that the named package is currently malicious. ### Attack Path 1. Whisper is absent from both `PATH` and the active Python environment. 2. A user invokes the transcription script. 3. `check_whisper_available()` returns `None`. 4. `main()` automatically calls `install_whisper()`. 5. ...[truncated 1031 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic package installation from the transcription runtime. 2. Treat dependency installation as a separate, explicit setup operation requiring user or administrator approval. 3. Pin `openai-whisper` and all transitive dependencies to reviewed versions in a lockfile or requirements file. 4. Verify downloaded artifacts with hashes, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 5. Install dependencies in a dedicated virtual environment with only the permissions required for transcription. 6. Remove `-U` from normal execution paths to prevent unexpected upgrades. 7. Use an explicitly trusted package index and prevent untrusted pip configuration from redirecting dependency resolution. 8. Fail safely with clear setup instructions when Whisper is unavailable instead of modifying the environment automatically. 9. Review and update pinned dependencies through a controlled maintenance process that includes vulnerability scanning and integrity verification.