T08 · Insecure Dependencies
Warning
- Location
SKILL.md:7- Finding
Unverified Package Installation Creates a Supply-Chain Substitution Risk
- Content
View full analysis
=3.8","packages":["requests","urllib3","python-dotenv"]},"install":[{"id":"pip","kind":"pip","package":"searxng-skill","label":"Install searxng-skill (pip)"},{"id":"local","kind":"local","command":"pip install -e .","label":"Install from source"}]}} ``` The uncertainty surrounding this installation source is corroborated by `README.md:23`: ```bash pip install searxng-skill # Not yet ready ``` ### Technical Analysis The skill metadata instructs an agent or skill manager to install `searxng-skill` from the configured Python package index. However, the project README states that this distribution is “Not yet ready,” and the skill metadata uses a placeholder repository URL rather than a verifiable project identity. Consequently, there is no reliable binding between the source code reviewed in this audit and the artifact that `pip install searxng-skill` will retrieve. The dependency is also not constrained by an exact version or cryptographic hash. This creates a package-substitution or dependency-confusion exposure. If the package name is unclaimed, compromised, transferred, or populated by a third party, automated installation could retrieve code that was not part of the audited project. Python packages may execute attacker-controlled behavior during build, installation, entry-point invocation, or later import. No evidence in the audited repository proves that the currently available package is malicious. The vulnerability is the unsafe and unverifiable installation instruction. ### Attack Path 1. A user or AI agent loads the skill metadata. 2. The installation mechanism selects the declared `pip` installer. 3. The environment runs `pip install searxn ...[truncated 1112 chars]- Remediation
View remediation
``` 6. Use trusted package indexes explicitly and prevent unexpected fallback to public indexes in controlled deployments. 7. Build releases through a reproducible, authenticated CI process and sign published artifacts where supported. 8. Ensure the README and skill metadata describe the same authoritative installation source. ]]>