T08 · Insecure Dependencies
- Location
SKILL.md:35- Finding
Unpinned Third-Party Package Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 35-48
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: MediumVulnerable Code
markdown If it is not installed, install the `stock` command-line tool first: **uv:** ```bash uv tool install agent-stockpip:
bash pip3 install agent-stockIf the user does not have
uvorpip, first help the user install a Python environment, and then install theagent-stockpackage withpip.text ### Technical Analysis The Skill directs the Agent to install `agent-stock` from the configured Python package index without pinning an audited version, verifying package hashes, using a lockfile, or validating the package source. Consequently, the effective dependency and its behavior may change after this Skill has been reviewed. Installing a Python package can execute package-controlled build or installation logic. The workflow subsequently invokes the package-provided `stock` executable. Because the dependency source is not included in this project, neither its installation behavior nor its runtime behavior can be verified by this audit. This creates a supply-chain risk involving a compromised upstream release, package-index substitution, dependency confusion caused by an unsafe private-index configuration, or an unreviewed future package version. ### Attack Path 1. An attacker compromises the `agent-stock` publishing account or causes a malicious package to resolve through the user's configured package index. 2. The Agent finds that the `stock` command is unavailable. 3. Following `SKILL.md`, the Agent runs `uv tool install agent-stock` or `pip3 install agent-stock`. 4. The package manager retrieves an unpinned, attacker-controlled package release. 5. Malicious installation logic may execute during installation, or malicious code may execute when the workflow later invokes the installed `stock` command. 6. The payload operates with the ...[truncated 866 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin
agent-stockto a specific version that has been independently reviewed, for example:bash uv tool install "agent-stock==X.Y.Z" -
Use a lockfile or hash-verified requirements file. With
pip, require hashes for the complete resolved dependency set:bash pip3 install --require-hashes -r requirements.txt -
Document and enforce the canonical package index and verified upstream project source. Do not silently rely on arbitrary indexes inherited from user or system configuration.
-
Require explicit user confirmation before installing packages or a Python runtime. Clearly disclose that third-party code will be downloaded and executed.
-
Prefer a prebuilt, reviewed environment or container containing the pinned CLI rather than performing installation during Skill execution.
-
Run the
stockCLI with least privilege in a restricted environment. Limit filesystem access, network access, environment-variable exposure, and access to credentials that are not required for stock analysis. -
Establish an update process that reviews new package versions before changing the pin, verifies package provenance and hashes, and repeats security testing.
-