T08 · Insecure Dependencies
- Location
SKILL.md:58- Finding
Unpinned Third-Party Dependencies Installed from an Unverified Package Index
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:58-62; related declarations also appear inREADME.md:36-37andmanifest.yaml:65-70
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: MediumVulnerable code snippet:
bash python -c "import docx" || pip install python-docxThe README independently instructs installation without a version or integrity constraint:
bash pip install python-docxThe manifest declares the dependencies without version constraints:
yaml requirements: python: ">=3.9" packages: - python-docx optional: - name: pypdfTechnical Analysis
The Skill instructs the Agent to install
python-docx, and optionallypypdf, from the currently configured pip package index without:- A reviewed version pin
- Cryptographic hashes
- A lockfile
- Explicit package-index validation
- User approval immediately before installation
Consequently, the dependency resolved during execution can differ from the version reviewed during the Skill audit. If the configured package index, upstream package, DNS/proxy path, or local pip configuration is compromised, an attacker-controlled distribution could be selected.
The main scripts import
docxduring startup, while PDF processing importspypdfwhen that feature is used. Therefore, malicious package code could execute when the installed dependency is subsequently imported. No evidence indicates that the project intentionally retrieves a malicious package; this finding concerns the absence of dependency integrity controls.Attack Path
- The required dependency is absent from the Agent environment.
- An attacker compromises the configured package source, an upstream release, or package-resolution infrastructure.
- The Skill follows its installation instruction and invokes pip without a pinned version or expected hash.
- Pip installs the att ...[truncated 966 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every dependency to a specifically reviewed version, including optional PDF dependencies.
- Maintain a lockfile or requirements file containing cryptographic hashes, and install with
pip install --require-hashes. - Configure an explicitly trusted package index rather than relying on ambient pip configuration.
- Prefer a prebuilt, isolated environment whose dependencies are installed and verified before the Skill executes.
- Do not automatically install missing packages during normal Skill operation. Report the missing dependency and obtain explicit user or administrator approval.
- Regularly scan pinned dependencies for known vulnerabilities and review updates before changing pins.
- Apply runtime least privilege and deny outbound network access unless it is required for a separately approved operation.