T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Python Dependencies Permit Supply-Chain Substitution## Vulnerability Details **File Location**: `SKILL.md`, lines 14-17; dependency execution is directed at line 32 **Vulnerability Type**: Unpinned third-party Python dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: pip package: ebooklib - kind: pip package: beautifulsoup4 ``` The workflow subsequently directs the agent to use these installed packages: ```markdown 2. If EPUB: write a Python script that uses the `ebooklib` and `beautifulsoup4` libraries (declared as dependencies in this skill) to extract text content from the EPUB file and save it as a clean TXT file. Run the script with `python3`. ``` ### Technical Analysis Both Python packages are declared without exact version constraints or cryptographic integrity hashes. Consequently, the package contents installed by `pip` can change independently of the reviewed skill. The effective executable dependency set is therefore not reproducible. Python packages can execute code during package installation and when imported by the generated preprocessing script. If a package release, transitive dependency, package-index account, or configured package source is compromised, attacker-controlled code may execute with the permissions of the account running the skill. The names shown are established packages rather than apparent typosquats, so this finding does not establish that the current releases are malicious. The risk arises from retrieving and executing mutable, unverified dependency versions. ### Attack Path 1. An attacker compromises a declared package, one of its transitive dependencies, its publishing account, or a package source trusted by the runtime. 2. The attacker publishes a malicious version that remains compatible with the unrestricted dependency declaration. 3. The skill installation process invokes `pip`, which resolves and downloads the malicious version because no reviewed version or hash is enforced ...[truncated 752 chars]
- Remediation
- ## Remediation Suggestions - Pin each direct dependency to a reviewed exact version, such as `package==x.y.z`. - Maintain a lock file that records the complete transitive dependency graph. - Require cryptographic hashes for every resolved artifact, for example through a hash-locked requirements file and `pip install --require-hashes`. - Use only an explicitly configured, trusted package index; prevent fallback to unapproved indexes. - Prefer prebuilt, reviewed artifacts and verify package provenance or signatures where available. - Install and execute dependencies inside a sandbox or virtual environment with minimal filesystem and network permissions. - Add automated dependency vulnerability and provenance scanning, and review changes before updating locked versions.