T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Runtime Dependency Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: Unpinned third-party dependency resolved and executed at runtime **Risk Level**: Medium ### Vulnerable Code ```text uv run --with replicate python {baseDir}/generate.py --prompt "<user prompt>" [--aspect-ratio 1:1] [--output image.png] ``` ### Technical Analysis The documented invocation directs `uv` to resolve, download, install, and execute the `replicate` package without specifying an exact version or enforcing a reviewed lockfile. Consequently, the code executed during each invocation can change independently of the audited skill. Python packages execute code during import, and `generate.py` imports this dependency immediately: ```python import replicate ``` The skill also requires `REPLICATE_API_TOKEN` in its environment. A compromised or unexpectedly malicious upstream package release would therefore execute with the same operating-system privileges and environment access as the skill process, including access to that API credential. This is a supply-chain weakness rather than evidence that the current `replicate` package is malicious. ### Attack Path 1. An attacker compromises the upstream package publisher, release process, package repository account, or another relevant dependency-distribution component. 2. The attacker publishes a malicious version that remains compatible with the unpinned package requirement. 3. A user invokes the documented `uv run --with replicate ...` command. 4. `uv` resolves and installs the attacker-controlled release because no exact version or integrity constraint is enforced. 5. `generate.py` imports `replicate`, causing its Python code to execute. 6. The malicious package reads `REPLICATE_API_TOKEN` or other data accessible to the process and may transmit it externally or perform additional actions under the invoking user's permissions. ### Impact Assessment Successful exploitation permits arbitrary Python code ex ...[truncated 703 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `replicate` to an exact, reviewed version rather than resolving the latest available release at invocation time. 2. Declare dependencies in a project configuration file and commit the generated `uv.lock` file. 3. Invoke the script with locked or frozen dependency resolution so execution fails if the lockfile cannot be honored. 4. Where supported, enforce package hashes or other integrity verification for downloaded distributions. 5. Review both direct and transitive dependencies before updating the lockfile. 6. Perform dependency updates through a controlled process that includes vulnerability scanning and behavioral review. 7. Run the skill in a least-privilege sandbox with access only to the required output directory and network endpoints. 8. Provide only `REPLICATE_API_TOKEN` to the process, avoid exposing unrelated credentials, and scope or rotate the token where the service permits. ]]>