T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unnecessary and Unpinned Third-Party Dependencies Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2`; installation instruction at `SKILL.md:259-263` **Vulnerability Type**: Unpinned and unnecessary third-party dependencies **Risk Level**: Medium ### Complete Code Snippet From `requirements.txt:1-2`: ```text dataclasses enum ``` From `SKILL.md:259-263`: ```markdown ## Prerequisites ```bash # Python dependencies pip install -r requirements.txt ``` ``` ### Technical Analysis The documented installation process asks users to resolve and install `dataclasses` and `enum` from the configured Python package index without version constraints or integrity hashes. Both `dataclasses` and `enum` are standard-library modules on supported modern Python versions. Installing external packages under these names is therefore unnecessary for the current implementation, which imports them as follows: ```python from dataclasses import dataclass, field from enum import Enum ``` Unpinned package resolution allows the downloaded artifact to change between installations. It also places trust in the active package index, mirrors, resolver configuration, and the current maintainers of packages whose names overlap with standard-library modules. Python packages can execute code during installation or when imported, so compromise or substitution can lead to local code execution. The project itself does not contain a malicious package or runtime download mechanism. Exploitation depends on the user following the installation instructions and resolving a compromised, substituted, or otherwise unsafe external distribution. ### Attack Path 1. A user follows the prerequisite documented in `SKILL.md`. 2. The user runs `pip install -r requirements.txt`. 3. Pip resolves mutable, unpinned packages from its configured package index or mirror. 4. An attacker compromises a listed distribution, controls an untrusted mirror, or influences package resolution. 5. Malicious installation logic executes during package ins ...[truncated 675 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `dataclasses` and `enum` from `requirements.txt` when supporting a modern Python version that includes both modules in the standard library. 2. Declare and enforce a minimum supported Python version, such as through `pyproject.toml` and runtime version checks. 3. Remove the `pip install -r requirements.txt` prerequisite if the project has no external dependencies. 4. If legacy Python support is essential, use the correct conditional backport only for affected interpreter versions. 5. Pin every required external dependency to an audited version and use hashes, for example with `pip install --require-hashes`. 6. Generate a lock file from a controlled package index and review transitive dependencies. 7. Run dependency installation in an isolated, least-privileged virtual environment or build container rather than as an administrator. ]]>