T08 · Insecure Dependencies
Warning
- Location
scripts/stock_utils.py:48- Finding
Automatic Installation and Upgrade of an Unpinned Third-Party Dependency
- Content
View full analysis
bool: """ Install or upgrade the thsdk library. """ try: pkg = f"thsdk=={version}" if version else "thsdk" print(f"[stock_utils] Installing {pkg}...") result = subprocess.run( [sys.executable, "-m", "pip", "install", "--upgrade", pkg], capture_output=True, text=True ) if result.returncode == 0: print("[stock_utils] thsdk installed successfully") return True else: print(f"[stock_utils] thsdk installation failed: {result.stderr}") return False except Exception as e: print(f"[stock_utils] thsdk installation exception: {e}") return False ``` The automatic installation is invoked when the installed version is considered too old or the package is missing: ```python if v_parts < min_parts: print( f"[stock_utils] thsdk version is too old " f"({version} < {THSDK_MIN_VERSION}); upgrading..." ) return install_thsdk() ... except ImportError: print("[stock_utils] thsdk is not installed; installing...") return install_thsdk() ``` The same unsafe behavior is explicitly prescribed in `SKILL.md`: ```bash pip install --upgrade thsdk ``` ### Technical Analysis The Skill automatically invokes pip during normal operation and requests the latest available release of `thsdk` whenever the package is absent or below the minimum version. The installation does not use: - An exact, audited version pin for the default installation path - A dependency lock file - Package or artifact hashes - An explicitly approved package index - Verification of transitive dependencies - User confirmation be ...[truncated 2168 chars]- Remediation
View remediation