T08 · Insecure Dependencies
Warning
- Location
- requirements.txt:1
- Finding
- Unpinned Python Dependencies Are Automatically Installed During Setup## Vulnerability Details **File Location**: `requirements.txt:1-3`, invoked by `scripts/setup_dependencies.py:183-190` **Vulnerability Type**: Supply-chain exposure through mutable dependency resolution **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-3`: ```text PyYAML>=6.0 python-docx>=1.1.0 PyMuPDF>=1.24 ``` `scripts/setup_dependencies.py:183-190`: ```python environment = root / "venv" python = environment / ("Scripts/python.exe" if os.name == "nt" else "bin/python") if not python.exists(): venv.EnvBuilder(with_pip=True).create(environment) run([ python, "-m", "pip", "install", "--disable-pip-version-check", "-r", SKILL / "requirements.txt", ]) ``` ### Technical Analysis All three Python dependencies use open-ended minimum-version constraints. Consequently, every new installation may resolve to a different package release. The setup routine automatically passes these mutable requirements to `pip` without a lock file, exact versions, or package hashes. Python packages can run build or installation logic during dependency installation. If a future matching release is compromised, malicious, or otherwise replaced upstream, the setup process can execute that release before the Skill performs its normal work. A benign but incompatible future release could also alter document parsing or rendering behavior. The private virtual environment limits package placement, but it does not sandbox installation-time code. Such code executes with the same operating-system identity and filesystem/network permissions as the agent running setup. ### Attack Path 1. An attacker compromises an upstream dependency account, release process, or distribution artifact. 2. The attacker publishes a version satisfying one of the open constraints, such as a future `PyMuPDF` release above `1.24`. 3. A user or agent runs `scripts/setup_dependencies.py`. 4. `pip ...[truncated 745 chars]
- Remediation
- ## Remediation Suggestions 1. Replace minimum-version constraints with exact, reviewed versions. 2. Generate a hash-locked dependency file containing hashes for all direct and transitive packages. 3. Install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Update dependencies through a controlled review process rather than resolving new versions during first-run setup. 5. Run vulnerability and provenance checks against the resolved dependency set in CI. 6. Where practical, use a trusted internal package mirror and disable unexpected source distributions. 7. Keep the private virtual environment, but do not treat it as a security sandbox.