T08 · Insecure Dependencies
Warning
- Location
install.sh:46- Finding
Unpinned Third-Party Packages Installed into the Host Python Environment
- Content
View full analysis
/dev/null; then echo " Installing optional packages..." # Try with --break-system-packages flag (for newer systems) pip3 install --break-system-packages --quiet language-tool-python textstat 2>/dev/null || \ # Fallback to --user flag pip3 install --user --quiet language-tool-python textstat 2>/dev/null || \ echo " Note: Could not install optional packages (this is OK)" ``` `SKILL.md:43-52`: ```bash # Install Python dependencies echo "📦 Installing Python packages..." pip3 install --break-system-packages --quiet \ language-tool-python \ textstat \ spacy 2>/dev/null || pip3 install --user --quiet \ language-tool-python \ textstat \ spacy ``` ### Technical Analysis The installation procedures retrieve packages from the active pip package index without pinning reviewed versions or validating package hashes. Consequently, the code installed and executed can change after the Skill itself has been audited. Python package installation may execute package-controlled build backend code or setup logic. A compromised package release, maliciously configured package index, dependency-confusion condition, or compromised transitive dependency could therefore execute arbitrary code under the account running the installer. The use of `--break-system-packages` additionally permits pip to alter a Python environment managed by the operating system. This can overwrite or conflict with shared Python components and increases the effect beyond an isolated Skill environment. The fallback to `--user` is safer in scope but remains unpinned and unverified. This does not constitute direct remote payload retrieval by the Skill b ...[truncated 1679 chars]- Remediation
View remediation
--hash=sha256: textstat== --hash=sha256: spacy== --hash=sha256: ``` 3. Install with hash validation and without dependency re-resolution: ```bash "$SKILL_DIR/venv/bin/python" -m pip install \ --require-hashes \ -r requirements.lock ``` 4. Remove `--break-system-packages`. The Skill does not require modification of the operating system’s managed Python environment. 5. Pin and review transitive dependencies, not only the three direct packages. 6. Document the approved package index and use an authenticated internal mirror where possible. 7. Make optional installation opt-in rather than automatically attempting network-based package installation on first use. 8. Run dependency vulnerability and provenance checks whenever the lock file is updated. ]]>