T08 · Insecure Dependencies
Error
- Location
scripts/fanqie_publisher.py:41- Finding
Unpinned external Skill dependencies are dynamically imported and executed
- Content
View full analysis
Dict: try: from main import check_login result = check_login() return result except Exception as e: return {"logged_in": False, "message": str(e)} ``` ```python def publish_chapter(self, work_title: str, chapter: Chapter, interval: int = 5) -> Dict: try: from main import publish_batch, load_chapters_from_file chapters = [{"title": chapter.title, "content": chapter.content}] results = publish_batch(work_title, chapters, interval=interval) ``` ### Technical Analysis The installation instructions do not pin dependency versions, package digests, source revisions, or publisher identities. At runtime, the application prepends the separately installed `fanqie-publisher` scripts directory to `sys.path` and imports a generically named `main` module from the resulting import search path. Python executes module-level code during import. Consequently, the imported dependency is not merely treated as passive data: it receives arbitrary code execution with the privileges of the user running this Skill. Because the dependency exists outside the audited project and can change independently, the effective runtime behavior is not bounded by the reviewed source tree. The generic `main` module ...[truncated 1635 chars]- Remediation
View remediation