T08 · Insecure Dependencies
Warning
- Location
- src/lao_huangli/astronomy.py:49
- Finding
- Unverified Third-Party Dependencies and Automatically Retrieved Ephemeris Artifact## Vulnerability Details **File Location**: `src/lao_huangli/astronomy.py:49-67`; related dependency declarations and installation instructions appear in `requirements.txt:1-2`, `SKILL.md:124-127`, and `scripts/huangli_calc.py:795-803`. **Vulnerability Type**: Supply-chain integrity failure caused by dependencies and runtime artifacts retrieved without cryptographic verification. **Risk Level**: Medium ### Vulnerable Code ```python def _cache_dir() -> Path: path = Path.home() / ".cache" / "lao-huangli" / "skyfield" path.mkdir(parents=True, exist_ok=True) return path @lru_cache(maxsize=1) def _loader() -> Loader: return Loader(str(_cache_dir())) @lru_cache(maxsize=1) def _timescale(): return _loader().timescale() @lru_cache(maxsize=1) def _ephemeris(): return _loader()(EPHEMERIS_NAME) ``` The requested ephemeris filename is defined without an accompanying expected digest: ```python DEFAULT_TIMEZONE = "Asia/Shanghai" EPHEMERIS_NAME = "de440s.bsp" ``` The dependencies are version-pinned but not hash-pinned: ```text skyfield==1.54 jplephem==2.24 ``` The documented installation path retrieves these packages from the configured Python package index: ```bash uv venv .venv uv pip install --python .venv/bin/python -r skills/lao-huangli/requirements.txt ``` The CLI also recommends an on-demand dependency installation command: ```python print( "缺少老黄历运行依赖：" f"{IMPORT_ERROR.name}\n" "推荐直接用 uv 运行，无需本地安装：\n" f" uv run --with skyfield==1.54 --with jplephem==2.24 python {script_path} 2026 3 9 12 --profile market-folk-v1 --format markdown\n" "或先安装依赖：\n" " uv venv .venv\n" " uv pip install --python .venv/bin/python -r skills/lao-huangli/requirements.txt", file=sys.stderr, ) ``` ### Technical Analysis Version pinning prevents unintended version upgrades but does not authenticate downloaded package contents. The project does not provide a lockfile containing cryptographic hashes or require hash verification ...[truncated 2784 chars]
- Remediation
- ## Remediation Suggestions 1. Generate and commit a reproducible dependency lockfile containing SHA-256 hashes for every package and transitive dependency. 2. Enforce hash verification during installation, such as a hash-locked requirements workflow with `--require-hashes`. 3. Restrict package retrieval to explicitly configured HTTPS repositories and avoid untrusted package mirrors. 4. Pin the expected source URL and SHA-256 digest of `de440s.bsp`. 5. Verify the ephemeris digest before every load, including when an existing cached copy is reused. 6. Delete and reject cached artifacts that fail verification rather than silently downloading or processing them. 7. Prefer bundling a verified ephemeris when licensing and package-size constraints permit. 8. If runtime retrieval remains necessary, require explicit user approval and document the remote host, artifact size, expected digest, and cache location. 9. Consider using a project-controlled, permission-restricted cache rather than an implicitly shared user-level cache. 10. Run dependency installation and calendar calculation inside a least-privilege environment without access to unrelated credentials or sensitive files.