T08 · Insecure Dependencies
- Location
src/lao_huangli/astronomy.py:49- Finding
Unverified Third-Party Dependencies and Automatically Retrieved Ephemeris Artifact
- Content
View full analysis
Vulnerability Details
File Location:
src/lao_huangli/astronomy.py:49-67; related dependency declarations and installation instructions appear inrequirements.txt:1-2,SKILL.md:124-127, andscripts/huangli_calc.py:795-803.Vulnerability Type: Supply-chain integrity failure caused by dependencies and runtime artifacts retrieved without cryptographic verification.
Risk Level: Medium
Vulnerable Code
python def _cache_dir() -> Path: path = Path.home() / ".cache" / "lao-huangli" / "skyfield" path.mkdir(parents=True, exist_ok=True) return path @lru_cache(maxsize=1) def _loader() -> Loader: return Loader(str(_cache_dir())) @lru_cache(maxsize=1) def _timescale(): return _loader().timescale() @lru_cache(maxsize=1) def _ephemeris(): return _loader()(EPHEMERIS_NAME)The requested ephemeris filename is defined without an accompanying expected digest:
python DEFAULT_TIMEZONE = "Asia/Shanghai" EPHEMERIS_NAME = "de440s.bsp"The dependencies are version-pinned but not hash-pinned:
text skyfield==1.54 jplephem==2.24The documented installation path retrieves these packages from the configured Python package index:
bash uv venv .venv uv pip install --python .venv/bin/python -r skills/lao-huangli/requirements.txtThe CLI also recommends an on-demand dependency installation command:
python print( "缺少老黄历运行依赖：" f"{IMPORT_ERROR.name}\n" "推荐直接用 uv 运行，无需本地安装：\n" f" uv run --with skyfield==1.54 --with jplephem==2.24 python {script_path} 2026 3 9 12 --profile market-folk-v1 --format markdown\n" "或先安装依赖：\n" " uv venv .venv\n" " uv pip install --python .venv/bin/python -r skills/lao-huangli/requirements.txt", file=sys.stderr, )Technical Analysis
Version pinning prevents unintended version upgrades but does not authenticate downloaded package contents. The project does not provide a lockfile containing cryptographic hashes or require hash verification ...[truncated 2784 chars]
- Remediation
View remediation
Remediation Suggestions
- Generate and commit a reproducible dependency lockfile containing SHA-256 hashes for every package and transitive dependency.
- Enforce hash verification during installation, such as a hash-locked requirements workflow with
--require-hashes. - Restrict package retrieval to explicitly configured HTTPS repositories and avoid untrusted package mirrors.
- Pin the expected source URL and SHA-256 digest of
de440s.bsp. - Verify the ephemeris digest before every load, including when an existing cached copy is reused.
- Delete and reject cached artifacts that fail verification rather than silently downloading or processing them.
- Prefer bundling a verified ephemeris when licensing and package-size constraints permit.
- If runtime retrieval remains necessary, require explicit user approval and document the remote host, artifact size, expected digest, and cache location.
- Consider using a project-controlled, permission-restricted cache rather than an implicitly shared user-level cache.
- Run dependency installation and calendar calculation inside a least-privilege environment without access to unrelated credentials or sensitive files.