T08 · Insecure Dependencies
Warning
- Location
- scripts/setup.sh:12
- Finding
- Unpinned Python dependency installation permits supply-chain substitution## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 12-15 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install requests library (the only dependency) echo "📦 Installing Python dependencies..." pip3 install requests --quiet echo " ✅ requests installed" ``` ### Technical Analysis The setup script installs `requests` directly from the Python package index without an exact version, integrity hash, lockfile, isolated virtual environment, or explicit trusted index. Consequently, installation results can change over time without any modification to the reviewed Skill. Although `requests` is a legitimate and widely used dependency, the command resolves its latest compatible release and its transitive dependencies at installation time. If the package publisher, package index, configured mirror, DNS/proxy infrastructure, or a transitive dependency is compromised, a malicious distribution could be selected. Python package installation can execute build-backend code while processing source distributions. A malicious package can therefore execute code during `pip3 install`, before the Skill imports or invokes the dependency. The absence of a virtual environment also allows the command to modify the invoking user's global or user-level Python environment. The same supply-chain concern applies to the documentation's unpinned `pip install edge-tts` instruction, but the directly executable installation sink is the command shown above. ### Attack Path 1. An attacker compromises the `requests` publishing account, a transitive dependency, the configured Python index or mirror, or another component in the package-resolution path. 2. The attacker publishes or serves a malicious package version or source distribution. 3. A user executes `scripts/setup.sh`. 4. `pip3 install requests --quiet` resolves the attacker-controlled artifact because ...[truncated 1296 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct and transitive Python dependency to an reviewed version in a dedicated requirements or lock file. 2. Record cryptographic hashes and enforce them during installation: ```text requests==2.32.5 \ --hash=sha256:<verified-wheel-hash> ``` ```bash python3 -m pip install \ --require-hashes \ --only-binary=:all: \ -r requirements.txt ``` 3. Generate and review a fully resolved lock file with tooling such as `pip-compile`, including hashes for all transitive dependencies. 4. Install dependencies into a Skill-specific virtual environment rather than the global Python environment: ```bash python3 -m venv .venv .venv/bin/python -m pip install --require-hashes -r requirements.txt ``` 5. Use `python3 -m pip` instead of a standalone `pip3` command to ensure dependencies are installed for the intended interpreter. 6. Explicitly configure the approved package index and prevent fallback to untrusted extra indexes. 7. Remove `--quiet` during security-sensitive installation or emit the resolved versions and artifact sources so users can audit what was installed. 8. Pin `edge-tts` and its transitive dependencies in the same lock file rather than directing users to run an unpinned installation command. 9. Add automated dependency scanning and a controlled update process in which version and hash changes are reviewed before release.