T08 · Insecure Dependencies
Warning
- Location
SKILL.md:57- Finding
Unpinned Third-Party Dependencies and Chromium Download from an Alternate Source
- Content
View full analysis
- Remediation
View remediation
" python3 -m playwright install chromium ``` - Pin `PyMuPDF` and `pikepdf` similarly. - Record Pandoc and Chromium versions known to be compatible. 2. **Use a lock file with hashes** - Maintain a requirements or lock file generated from reviewed dependencies. - Require hashes where supported: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` - Review and update the lock file through a controlled dependency-update process. 3. **Verify browser artifacts** - Document the expected Chromium revision and cryptographic checksums. - Verify downloaded artifacts before execution. - Prefer signed official distributions and verify signatures where available. 4. **Reduce reliance on alternate sources** - Use the official Playwright download infrastructure by default. - If a mirror is necessary, document its trust assumptions and require checksum validation against independently published official values. 5. **Require explicit user authorization** - Do not automatically install packages during Skill initialization. - Clearly show the source, version, expected download size, and command, then obtain user approval before execution. 6. **Install in an isolated environment** - Use a dedicated virtual environment or container with minimal filesystem and network access. - Avoid installing or running the conversion workflow as root or an administrator. - Do not expose unrelated credentials or sensitive environment variables to the installation process. 7. **Restore and audit the missing implementation** - Include the referenced `scripts/md2pdf.py` in the distributed package. - Audit it for command injection, unsafe file handling, unrestricted network requests, ...[truncated 90 chars]