T08 · Insecure Dependencies
Warning
- Location
SKILL.md:53- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 53-57
Vulnerability Type: Uncontrolled third-party dependency version
Risk Level: MediumVulnerable Code
markdown ## Dependencies ```bash pip3 install python-docxtext ### Technical Analysis The documented installation command retrieves `python-docx` without specifying an audited version or verifying an integrity hash. Consequently, the version installed depends on the package index state at installation time and may differ from the version originally reviewed with this Skill. This creates a software supply-chain risk. If the upstream package, maintainer account, release process, configured package index, or dependency resolution path is compromised, following the documented command could install attacker-controlled code. There is no evidence in the audited project that the legitimate `python-docx` package is currently malicious; the vulnerability is the absence of reproducible dependency controls. ### Attack Path 1. An attacker compromises the upstream package distribution process, a configured Python package index, or a future dependency release. 2. A user follows the Skill documentation and executes `pip3 install python-docx`. 3. `pip` resolves and downloads the uncontrolled package release and its dependencies. 4. Malicious installation or imported runtime code executes under the identity and permissions of the user or automation account running the Skill. 5. The malicious dependency could access files and environment data available to that account, alter generated documents, or perform additional actions permitted by the host environment. ### Impact Assessment Successful exploitation requires compromise or manipulation of the dependency supply chain. If that prerequisite is met, code can execute with the privileges of the account performing installation or running the document generator. The accessible scope may include quotati ...[truncated 357 chars]- Remediation
View remediation
Remediation Suggestions
- Add a dependency manifest containing an explicitly audited version, for example:
text python-docx==<audited-version> - Generate and record cryptographic hashes for the package and its transitive dependencies.
- Install with hash enforcement:
bash python3 -m pip install --require-hashes -r requirements.txt - Use a lock file or equivalent reproducible dependency-management mechanism so transitive versions cannot change unexpectedly.
- Obtain packages only from an approved index over TLS and disable untrusted extra package indexes.
- Run dependency installation and document generation in an isolated virtual environment or container with least-privilege filesystem and network access.
- Periodically scan locked dependencies for disclosed vulnerabilities and review updates before changing pinned versions.
- Add a dependency manifest containing an explicitly audited version, for example: