T08 · Insecure Dependencies
Warning
- Location
riffusion.md:23- Finding
Unpinned Third-Party Dependencies and Mutable Repository Content
- Content
View full analysis
Vulnerability Details
File Locations:
musicgen.md:18-22stable-audio.md:34-38replicate.md:7-12riffusion.md:23-30
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: MediumAffected Code:
musicgen.md:18-22bash ## Installation ```bash pip install audiocrafttext `stable-audio.md:34-38` ```bash ## Local Setup (Open Model) ```bash pip install stable-audio-toolstext `replicate.md:7-12` ```bash ## Setup ```bash pip install replicate export REPLICATE_API_TOKEN="r8_xxx"text `riffusion.md:23-30` ```bash ## Local Setup ```bash git clone https://github.com/riffusion/riffusion.git cd riffusion pip install -r requirements.txttext ### Technical Analysis The installation instructions retrieve mutable packages and repository content without pinning package versions, validating cryptographic hashes, or checking out a reviewed commit. Package installation can execute build-system hooks, setup scripts, native extensions, and subsequently imported package code with the privileges of the user running the commands. The Riffusion workflow is particularly exposed because it clones the repository's current default branch and immediately installs its dependency file. The effective code and dependency set can therefore change after this Skill has been reviewed. These instructions do not demonstrate a currently malicious dependency. The vulnerability is the lack of controls needed to ensure that the installed code remains identical to reviewed code. ### Attack Path 1. An upstream package, repository, maintainer account, release process, or transitive dependency is compromised. 2. The attacker publishes a malicious release or modifies the repository's default branch or dependency declarations. 3. A user follows the Skill's unpinned `pip install` or `git clone` instructions. 4. The package manager ...[truncated 852 chars]- Remediation
View remediation
Remediation Suggestions
- Pin every package to a reviewed version, for example
package==X.Y.Z. - Use a lock file containing all transitive dependency versions.
- Require package hashes with
pip install --require-hashes. - Pin Git repositories to a reviewed immutable commit SHA rather than the default branch.
- Verify repository ownership and package provenance before installation.
- Install dependencies in a dedicated virtual environment or isolated container without elevated privileges.
- Use a restricted service account and prevent dependency installation from accessing unrelated credentials or sensitive files.
- Scan packages and lock files with software-composition analysis tools before use.
- Separate dependency installation from runtime and review all installation scripts and build hooks.
- Document the exact versions and commit identifiers tested with the Skill.
- Pin every package to a reviewed version, for example