T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Dependencies Permit Unreviewed Package Resolution## Vulnerability Details **File Locations**: - `SKILL.md:8` - `SKILL.md:39-45` - `references/troubleshooting.md:16` - `references/troubleshooting.md:32` - `references/troubleshooting.md:46` **Vulnerability Type**: Unpinned and lower-bound-only third-party dependencies **Risk Level**: Medium **Complete Code Snippets**: `SKILL.md:8`: ```yaml dependencies: [peft>=0.13.0, transformers>=4.45.0, torch>=2.0.0, bitsandbytes>=0.43.0] ``` `SKILL.md:39-45`: ```bash # Basic installation pip install peft # With quantization support (recommended) pip install peft bitsandbytes # Full stack pip install peft transformers accelerate bitsandbytes datasets ``` `references/troubleshooting.md:16`: ```bash pip install bitsandbytes --no-cache-dir ``` `references/troubleshooting.md:32`: ```bash pip install triton ``` `references/troubleshooting.md:46`: ```bash pip install peft>=0.13.0 --upgrade ``` ### Technical Analysis These installation instructions use unconstrained dependencies or minimum-version constraints instead of exact, reviewed versions. Package resolution therefore depends on the contents of the package index at installation time. The resolved package and its transitive dependencies can change after the Skill has been audited. Python packages may execute build backends or installation-related code during installation. Consequently, compromise of a package publisher account, malicious dependency publication, dependency confusion in a mixed public/private index environment, or a compromised transitive dependency could turn these commands into a local code-execution path. The use of `--no-cache-dir` does not provide integrity protection. It only bypasses the local package cache and may increase reliance on newly downloaded artifacts. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, or the package index account used to publish it. 2. ...[truncated 1226 chars]
- Remediation
- ## Remediation Suggestions 1. Replace unconstrained and minimum-only requirements with exact versions that have been reviewed and tested. 2. Maintain a lock file or fully resolved requirements file containing all transitive dependencies. 3. Record and enforce artifact hashes, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Generate the hashed requirements file from a controlled environment and review dependency changes before updating it. 5. Recommend installation in a dedicated virtual environment or disposable container rather than a system Python environment. 6. Avoid installing packages with administrator privileges. 7. Configure trusted package indexes explicitly and prevent unintended fallback to public indexes where private package names are involved. 8. Add automated dependency vulnerability, provenance, and license scanning to the release process. 9. Document a tested version matrix for PEFT, Transformers, PyTorch, bitsandbytes, Triton, CUDA, and related dependencies.