T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:16
- Finding
- Unpinned Third-Party Python Dependencies<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:16-20` - `SKILL.md:89-92` - `README.md:8-11` - `README.md:120-125` **Vulnerability Type**: Supply-chain exposure through mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:16-20`: ```yaml install: - id: python kind: python packages: - pyautogui - Pillow ``` `SKILL.md:89-92`: ```bash pip install pyautogui Pillow ``` `README.md:8-11`: ```bash pip install pyautogui Pillow ``` `README.md:120-125`: ```bash pip install --upgrade pyautogui Pillow ``` ### Technical Analysis The installation declarations and commands identify dependencies only by package name. They do not constrain them to reviewed versions, verify distribution hashes, lock transitive dependencies, or require an explicitly trusted package index. Consequently, the code installed for the same Skill version can change over time. The `--upgrade` recommendation explicitly asks pip to retrieve newer releases, further increasing exposure to a subsequently compromised package or transitive dependency. Python packages can execute code during installation and whenever imported. This project imports both dependencies when `click_extension.py` starts. Moreover, `pyautogui` is used for screen capture, pointer observation, and GUI interaction, so a malicious dependency would execute in a context with access to the invoking user's desktop session. No evidence shows that the currently named packages are malicious. The vulnerability is the absence of controls that ensure users receive the exact dependency artifacts reviewed by the Skill publisher. ### Attack Path 1. An attacker compromises a named dependency, one of its transitive dependencies, or the package distribution channel used by pip. 2. The attacker publishes or substitutes a malicious release that satisfies the unconstrained package request. 3. A user installs the Skill dependencies using the documented command or aut ...[truncated 1181 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version: ```text pyautogui==<reviewed-version> Pillow==<reviewed-version> ``` 2. Generate a lock file that includes all transitive dependencies rather than constraining only direct dependencies. 3. Record cryptographic hashes for every permitted distribution and enforce them during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Configure installation to use an explicitly trusted package index, and prevent fallback to untrusted or unintended indexes. 5. Remove the unconstrained upgrade recommendation. Dependency updates should be reviewed, tested, and accompanied by regenerated hashes before publication. 6. Run installation and the Skill as a non-administrative user inside an isolated virtual environment. Do not use `sudo pip` or an equivalent elevated installation process. 7. Add automated dependency scanning and provenance checks to the release process. Review both direct and transitive dependency changes before updating the lock file. 8. Update `SKILL.md` and `README.md` so all documented and automated installation paths use the same locked, hash-verified dependency set. ]]>