T08 · Insecure Dependencies
Warning
- Location
SKILL.md:61- Finding
Unpinned Third-Party Package Installation and Execution
- Content
View full analysis
Vulnerability Details
File Locations:
SKILL.md:61-75coverage-recipes.md:11-41coverage-recipes.md:56-62coverage-recipes.md:82-92coverage-recipes.md:118-120coverage-recipes.md:185coverage-recipes.md:209coverage-recipes.md:272-290coverage-recipes.md:307coverage-recipes.md:385coverage-recipes.md:435-449coverage-recipes.md:565-603coverage-recipes.md:618
Vulnerability Type: T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
SKILL.md:61-75:markdown ### Automatically install missing coverage tools If the project has a test framework but lacks a coverage tool, install one automatically: | Language | Condition | Installation command | |----------|-----------|----------------------| | Python | pytest exists but pytest-cov is absent | `pip install pytest-cov` | | JS/TS (Jest) | No --coverage configuration | Built in; no installation required | | JS/TS (Vitest) | No @vitest/coverage-* package | `npm install -D @vitest/coverage-v8` | | Go | — | Built-in `go test -cover`; no installation required | | Rust | No cargo-tarpaulin/llvm-cov | `cargo install cargo-llvm-cov` | | Java (Maven) | No JaCoCo plugin | Add the JaCoCo plugin to pom.xml | | Java (Gradle) | No jacoco plugin | Add `id 'jacoco'` to build.gradle | | C#/.NET | No coverlet | `dotnet add package coverlet.collector` | Confirm with AskQuestion before installation.The original document is written partly in Chinese; the excerpt above is an English rendering of the complete affected section. The executable commands are reproduced exactly.
Representative commands from
coverage-recipes.md:bash npm install -D @vitest/coverage-v8 npm install -D c8 pip install pytest-cov cargo install cargo-llvm-cov npx jest --coverage --coverageReporters=text --coverageReporters=lcov npx vitest run --coverage --coverage.reporter=text --cover ...[truncated 3490 chars]- Remediation
View remediation
Remediation Suggestions
- Pin every installed tool to an exact, reviewed version, for example:
pip install pytest-cov==<reviewed-version>npm install --save-dev @vitest/coverage-v8@<reviewed-version>cargo install cargo-llvm-cov --version <reviewed-version> --locked
- Prefer dependencies already declared in the project and resolved through committed lockfiles, such as
package-lock.json,pnpm-lock.yaml,poetry.lock, orCargo.lock. - Prevent implicit downloads during execution. Use locally installed binaries and commands such as
npx --no-installor an equivalent offline/local-only mode where supported. - Display the exact resolved version, registry source, package name, and proposed command before requesting explicit user approval.
- Verify package hashes, signatures, attestations, or lockfile integrity where the ecosystem supports them.
- Disable package lifecycle scripts when they are unnecessary and supported, such as using npm's
--ignore-scripts, after confirming that the selected tool does not require them. - Install tools in an isolated virtual environment, container, or restricted build environment with minimal filesystem and network access.
- Avoid global installations such as
dotnet tool install -g; use project-local tool manifests or isolated environments instead. - Configure approved registries explicitly and protect against dependency confusion by validating package scope and registry mapping.
- Update all command templates in
coverage-recipes.mdso they use the same pinned, verified, and local-only dependency policy.
- Pin every installed tool to an exact, reviewed version, for example: