T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:52
- Finding
- Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 52-56 **Vulnerability Type**: Unpinned and integrity-unverified package installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### 2. Install the dependency ```bash pip install requests ``` ``` ### Technical Analysis The setup instructions install `requests` from the package index without specifying a reviewed version, lock file, package hash, or trusted index. Dependency resolution is therefore mutable: a future installation may retrieve a different package version or dependency graph than the one reviewed during this audit. Python package installation can execute package build or installation logic. If the selected release, one of its transitive dependencies, the configured package index, or the package-resolution environment is compromised, installation can result in arbitrary code execution. The Skill also declares broad `Bash(pip:*)` permission. This allows more pip operations than the Skill's market-data functionality inherently requires and weakens least-privilege enforcement around dependency installation. No evidence was found that the legitimate `requests` package is currently malicious. The vulnerability is the absence of version and integrity controls around executable third-party content. ### Attack Path 1. A user or agent follows the documented setup procedure. 2. The agent invokes `pip install requests` using the broadly permitted pip tool. 3. Pip dynamically resolves the package and its dependencies from the configured package index. 4. An attacker compromises an applicable package release, transitive dependency, index, mirror, or package-resolution configuration. 5. Pip downloads and processes the attacker-controlled distribution. 6. Malicious build or installation code executes with the privileges of the user running the agent. ### Impact Assessment Successful exploitation could execute arbitrary code with the current user's privileges. Depending on ...[truncated 292 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `requests` and all transitive dependencies to reviewed versions in a lock file. 2. Require package hashes, for example through a hash-locked requirements file and `pip install --require-hashes`. 3. Use an explicitly trusted package index and disable unintended extra indexes. 4. Prefer `python -m pip` so installation uses the intended Python interpreter. 5. Install dependencies inside an isolated virtual environment with no elevated privileges. 6. Replace broad `Bash(pip:*)` authorization with the narrowest command permission supported by the host. 7. Add automated dependency scanning and a controlled process for reviewing and updating pinned versions. ]]>