T08 · Insecure Dependencies
Warning
- Location
- scripts/parse_paper.py:2
- Finding
- Automatically Resolved Third-Party Dependencies Are Not Reproducibly Pinned## Vulnerability Details **File Location**: `scripts/parse_paper.py:2-7` **Related Documentation**: `SKILL.md:54-58` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "PyMuPDF>=1.23.0", # "pymupdf4llm>=0.0.10", # ] # /// ``` The related documentation states: ```markdown ## Dependencies - PyMuPDF (fitz) - PDF parsing and rendering - pymupdf4llm - Markdown conversion These are automatically managed by uv via the inline script metadata. ``` ### Technical Analysis The inline dependency metadata specifies only minimum versions. It does not provide exact reviewed versions, integrity hashes, a committed lockfile, or a restricted package source. Consequently, the documented `uv run` workflow may resolve and install any future package release that satisfies these constraints. Python dependencies execute inside the invoking process when imported and may also run installation or build-related code depending on the resolved distribution. This means the effective code executed by the Skill can change after the Skill itself has been reviewed. It also makes builds non-reproducible: two executions at different times may resolve materially different dependency versions. This finding does not establish that either named dependency is currently malicious. The risk arises from permitting automatically selected, unreviewed future versions and relying on the package distribution channel without a reproducible dependency lock. ### Attack Path 1. An attacker compromises a future release of `PyMuPDF` or `pymupdf4llm`, an associated maintainer account, or the package distribution channel. 2. The compromised release retains a version satisfying the declared lower-bound constraint. 3. A user invokes the documented command through `uv run` in an environment where dependencies are not already locked and cached. 4. `uv` resolves and installs th ...[truncated 1095 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each dependency to an exact, reviewed version rather than using open-ended minimum constraints. 2. Generate and commit a `uv.lock` file so dependency resolution is reproducible. 3. Run the Skill with `uv run --locked` or `uv run --frozen` to prevent silent dependency updates. 4. Verify downloaded artifacts using integrity hashes or an organization-controlled package mirror. 5. Restrict package resolution to trusted indexes and disable unapproved supplemental indexes to reduce dependency-confusion exposure. 6. Introduce a controlled dependency-update process that includes vulnerability scanning, release review, automated tests, and explicit lockfile updates. 7. Execute PDF parsing in a sandbox or container with minimal filesystem access, no unnecessary credentials, and network access disabled unless explicitly required.