T08 · Insecure Dependencies
Warning
- Location
- scripts/cli.sh:29
- Finding
- Automatic Installation of Unpinned Dependencies with PEP 668 Protection Bypass## Vulnerability Details **File Location**: `scripts/cli.sh:29-52`; dependency constraints are defined in `requirements.txt:1-3` **Vulnerability Type**: Unsafe automatic dependency installation and package-management protection bypass **Risk Level**: Medium **Vulnerable code in `scripts/cli.sh`:** ```bash # 首次运行：检查依赖，没有就提示安装 if ! "$PY" -c "import langgraph, langchain_anthropic" 2>/dev/null; then echo "⚠️ 检测到首次运行，需要安装依赖..." >&2 # 检测 PEP 668（Debian/Ubuntu 系统 Python 保护） # 用 set +e +o pipefail 同时禁用错误退出和 pipefail # （因为 pip dry-run 遇到 PEP 668 会 exit 1，但 grep 找到需要退出 0） PEP668_FLAG="" set +e +o pipefail "$PY" -m pip install --dry-run -r "$REQ" 2>&1 | grep -q "externally-managed-environment" PEP668_DETECTED=$? set -e -o pipefail if [[ $PEP668_DETECTED -eq 0 ]]; then PEP668_FLAG="--break-system-packages" echo " 检测到 PEP 668 保护，自动加 --break-system-packages" >&2 fi echo " 自动执行：$PY -m pip install $PEP668_FLAG -r $REQ" >&2 "$PY" -m pip install $PEP668_FLAG --user -r "$REQ" 2>&1 | tail -5 if ! "$PY" -c "import langgraph, langchain_anthropic" 2>/dev/null; then echo "❌ 依赖安装失败，请手动：$PY -m pip install $PEP668_FLAG -r $REQ" >&2 exit 1 fi echo "✅ 依赖装好" >&2 fi ``` **Dependency constraints in `requirements.txt`:** ```text langgraph>=1.2.0 langchain-anthropic>=1.4.0 pytest>=9.0.0 ``` ### Technical Analysis The CLI automatically invokes `pip` when the required imports are unavailable. All three dependencies use open-ended lower-bound constraints and have neither exact version pins nor package hashes. A future release satisfying these constraints is therefore eligible for automatic installation without having been reviewed as part of this skill. Python package installation can execute package build hooks and other installation-time behavior with the privileges of the user running the skill. Thi ...[truncated 2249 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic installation into the current or OS-managed interpreter. Create and use a dedicated virtual environment under the skill directory or an approved application data directory. 2. Never add `--break-system-packages` automatically. If an externally managed environment is detected, stop with a clear instruction to create an isolated virtual environment. 3. Replace open-ended dependency constraints with an auditable lockfile containing exact versions for direct and transitive dependencies. 4. Use `pip --require-hashes` with hashes generated from trusted artifacts to prevent unreviewed package substitutions. 5. Require explicit user confirmation before any network-backed installation, and clearly identify the package index and packages to be installed. 6. Remove `langgraph` because the current Python implementation does not use it. Remove `pytest` from runtime dependencies unless the skill actually executes tests. 7. Add automated dependency review, vulnerability scanning, and controlled lockfile update procedures. 8. Consider installing from a trusted internal package mirror or otherwise restricting the approved package source.