T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:210
- Finding
- Unpinned Third-Party Runtime Dependencies## Vulnerability Details **File Location**: `SKILL.md:210`, `scripts/doc2txt.py:17`, and `scripts/convert_to_word.py:26` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:210`: ```text - Dependencies: `pip install python-docx pymupdf olefile openpyxl` (pure pip, no system dependencies) ``` `scripts/doc2txt.py:17`: ```text pip install python-docx olefile pymupdf openpyxl ``` `scripts/convert_to_word.py:26`: ```text Dependency: pip install python-docx ``` ### Technical Analysis The installation instructions identify package names but do not constrain versions, verify artifact hashes, or provide a lockfile. Consequently, package resolution depends on the mutable state of the configured Python package index at installation time. The conversion scripts subsequently import and execute these dependencies when processing tender documents. For example, `doc2txt.py` imports `docx`, `olefile`, `fitz`, and `openpyxl`, while `convert_to_word.py` imports `python-docx`. Python packages can execute initialization code during import and additional package-controlled code while parsing a document. This does not establish that any listed package is currently malicious. The weakness is that the project lacks controls ensuring that users install the same reviewed artifacts. A compromised upstream release, package-index compromise, or unsafe private-index configuration could therefore introduce unreviewed executable code. ### Attack Path 1. An attacker compromises a dependency release or causes the victim's configured package index to resolve an attacker-controlled distribution. 2. A user follows the documented unpinned `pip install` command. 3. `pip` downloads and installs the uncontrolled release without project-supplied version or hash verification. 4. The user invokes document conversion or Word generation. 5. The script imports the installed dependency or ...[truncated 820 chars]
- Remediation
- ## Remediation Suggestions 1. Create a reviewed dependency file containing exact versions, for example: ```text python-docx==REVIEWED_VERSION PyMuPDF==REVIEWED_VERSION olefile==REVIEWED_VERSION openpyxl==REVIEWED_VERSION ``` 2. Generate and record cryptographic hashes for every accepted distribution, including transitive dependencies. 3. Require hash verification during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Commit a lockfile generated by a reproducible dependency-management tool and use it consistently in development, testing, and deployment. 5. Configure installations to use an approved package index over TLS and avoid untrusted supplemental indexes. 6. Run document conversion in an isolated, least-privileged environment with restricted filesystem and network access. 7. Establish a dependency-update process that includes vulnerability scanning, release review, compatibility testing, and regeneration of locked hashes.