T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:28
- Finding
- Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28–32 **Vulnerability Type**: Unpinned runtime dependency **Risk Level**: Medium ### Vulnerable Code ```bash pip install requests ``` ### Technical Analysis The installation instructions install `requests` without specifying an approved version or validating package integrity with cryptographic hashes. Consequently, the package version and its transitive dependency set may change between installations without any corresponding change to the reviewed Skill. Although `requests` is a legitimate package, an unpinned installation remains exposed to supply-chain risks such as a compromised package release, compromised package index, malicious index configuration, or an unexpectedly vulnerable or incompatible future release. The script imports the installed package immediately at runtime: ```python import requests, re, sys, os, xml.etree.ElementTree as ET ``` Code contained in a compromised dependency can therefore run when the module is imported or used. The project does not provide a lock file, hash-validated requirements file, or documented package-index restriction. ### Attack Path 1. An attacker compromises a future package release, a transitive dependency, or the package index used by the victim. 2. Alternatively, the victim's pip configuration is redirected to an attacker-controlled index or mirror. 3. The user follows the documented instruction and runs `pip install requests`. 4. Pip resolves an uncontrolled package version and installs the affected distribution. 5. The user starts `scripts/morning_briefing.py`. 6. Malicious dependency code executes in the context of the user running the script when the dependency is imported or invoked. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the privileges of the account running pip or the briefing script. This may permit access to files available to that account, modification of generated reports, ...[truncated 310 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a dependency file containing a reviewed and explicitly pinned version, for example: ```text requests==<reviewed-version> ``` 2. Generate and require cryptographic hashes for the package and all transitive dependencies, using a tool such as `pip-compile --generate-hashes`. 3. Install dependencies with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Document use of the official PyPI HTTPS index or an organization-controlled authenticated mirror. 5. Install the package inside a dedicated virtual environment rather than into a system-wide Python environment. 6. Regularly review and deliberately update the locked dependency set after vulnerability and compatibility testing. ]]>