T08 · Insecure Dependencies
Warning
- Location
SKILL.md:181- Finding
Unpinned Third-Party Dependencies Create Supply-Chain and Reproducibility Risks
- Content
View full analysis
--output config.json` (depends on python-docx) - Content filling: `python scripts/autofill_prepare.py --parsed config.json --content content.json --out bid_config.json` - Generate: `node scripts/generate_bid_template.js --config bid_config.json --out bid-document.docx` (depends on the docx package) - Price-rule extraction: `python scripts/extract_price_rules.py --out ./out` (PDF requires pypdf; txt has no dependencies; produces a draft price_config.json and price_config.review.md) ``` The PDF extractor also recommends an unconstrained installation in `scripts/extract_price_rules.py`, lines 52–55: ```python try: import pypdf # type: ignore except ImportError: sys.exit("[Error] Reading PDF requires pypdf. Run `pip install pypdf` first; " "or save the price-scoring section as a .txt file.") ``` ### Technical Analysis The project relies on the third-party packages `python-docx`, `pypdf`, and the npm package `docx`. No dependency manifest, lockfile, exact version constraint, integrity hash, or reviewed registry configuration is included in the audited directory. Consequently, installation instructions such as `pip install pypdf` resolve whichever release is current at installation time. The same project can therefore execute materially different dependency code across environments. If a dependency release or package-distribution account is compromised, malicious package code could execute during installation or import with the permissions of the user or Agent running the Skill. This finding does not establish that any currently named package is malicious. It identifies an uncontrolled supply-chain boundary and lack of reproducible dep ...[truncated 989 chars]- Remediation
View remediation