T08 · Insecure Dependencies
Error
- Location
- agent.py:7
- Finding
- Unpinned Runtime Dependency Installation During Module Initialization## Vulnerability Details **File Location**: `agent.py`, lines 7-17 **Vulnerability Type**: Uncontrolled runtime package installation **Risk Level**: High **Vulnerable Code**: ```python def install_dependencies(): required_packages = ["qrcode", "pillow"] for package in required_packages: try: __import__(package) # Check whether the library is installed except ImportError: # Automatically install the missing library subprocess.check_call([sys.executable, "-m", "pip", "install", package]) # Initialization: install dependencies install_dependencies() ``` ### Technical Analysis The module invokes pip automatically during initialization whenever a dependency check fails. Package names are not constrained by version pins, integrity hashes, a lock file, or a trusted package index. Consequently, the code installed and executed by pip can change after the skill has been reviewed. The check for Pillow is also incorrect: Pillow exposes the `PIL` import namespace rather than `pillow`. Therefore, `__import__("pillow")` normally raises `ImportError` even when Pillow is already installed, potentially causing pip to be invoked every time the module is initialized. The installation mechanism is also unreliable for genuinely missing dependencies because `qrcode` and `PIL` are imported at lines 1-2 before `install_dependencies()` runs. If either initial import fails, execution terminates before the installation function can repair the environment. This does not mitigate the supply-chain risk when the top-level imports succeed but the incorrect `pillow` check triggers installation. ### Attack Path 1. An attacker compromises, controls, or redirects the Python package index configured in the execution environment. 2. The skill module is imported. 3. The `pillow` import check fails because the package's actual import namespace is `PIL`, or another dependency check fails ...[truncated 855 chars]
- Remediation
- ## Remediation Suggestions - Remove all automatic package installation from module import and runtime execution paths. - Declare dependencies in a dedicated dependency manifest and install them during an explicit, isolated deployment step. - Pin exact reviewed versions of `qrcode` and `Pillow`. - Use a lock file or hash-verified installation mode, such as pip's `--require-hashes`. - Restrict installation to an explicitly trusted package index and disable unintended fallback indexes. - Build and scan dependencies in CI before deployment rather than modifying the environment when the skill loads. - If a diagnostic dependency check remains necessary, check Pillow with `import PIL` and return a clear error without invoking pip. - Run the deployed skill under a least-privileged account and in an environment where installed dependencies are immutable.