T08 · Insecure Dependencies
- Location
SKILL.md:106- Finding
Unpinned Third-Party Dependencies Executed at Runtime
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 106
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
markdown 读取 XLSX 使用 `uv run --with openpyxl python3` 或 `uv run --with pandas python3`。English translation: “To read XLSX files, use
uv run --with openpyxl python3oruv run --with pandas python3.”Technical Analysis
The Skill instructs the Agent to resolve and execute
openpyxlorpandasdynamically throughuvwithout specifying exact versions, hashes, a lockfile, or a trusted package-index configuration.This makes execution dependent on package artifacts available when the command is run rather than on dependencies fixed and reviewed with the Skill. If a package release, configured package index, dependency, or resolver configuration is compromised, malicious code could execute during dependency installation or import.
The audit found no evidence that
openpyxlorpandasis currently malicious. The issue is the unsafe, unpinned dependency-resolution mechanism and its resulting supply-chain exposure.Attack Path
- An attacker compromises a package release, transitive dependency, configured Python package index, or resolver configuration used by
uv. - The Agent follows the instruction in
SKILL.mdto process an XLSX file. uvdynamically resolves and retrieves the unpinned package and its dependencies.- Malicious package code executes during installation or when imported by the Python process.
- The code runs with the permissions and environmental access of the Agent process.
- It can access files, environment variables, and network resources available to that process, including reachable workspace investment records.
Impact Assessment
Successful exploitation could provide arbitrary code execution with the Agent process's existing privileges. The accessible scope could include:
- Reading or modifying proj ...[truncated 543 chars]
- An attacker compromises a package release, transitive dependency, configured Python package index, or resolver configuration used by
- Remediation
View remediation
Remediation Suggestions
- Declare dependencies in a reviewed
pyproject.tomland pin exact versions in a committeduv.lock. - Require locked execution, preventing the resolver from silently selecting newer package versions.
- Verify package artifacts with hashes and obtain them only from an explicitly configured, trusted package index.
- Review and pin transitive dependencies as well as direct dependencies.
- Avoid runtime package installation where possible; use a prebuilt, scanned environment containing approved versions.
- Run spreadsheet processing in a sandbox with least-privilege filesystem access, no unnecessary credentials, and restricted outbound networking.
- Treat XLSX files as untrusted input and keep spreadsheet-processing libraries updated through a controlled dependency-review process.
- Add automated dependency scanning and lockfile-integrity checks to the release workflow.
- Declare dependencies in a reviewed