T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:44
- Finding
- Unpinned Third-Party Dependency Installation and Execution< (private, self-hosted, free). ``` ### Technical Analysis The Skill instructs the user or Agent to install `solograph` and `yt-dlp` directly from mutable package registries without specifying reviewed versions, cryptographic hashes, a lockfile, or a trusted package index. Consequently, the dependency resolved during a future invocation may differ from the dependency available when the Skill was audited. The `uvx solograph` alternative is particularly sensitive because `uvx` obtains the package and immediately runs its entry point. A compromised package version, compromised publisher account, registry substitution, or malicious package selected through repository configuration could therefore introduce executable code into the Agent environment. The audit did not find evidence that the named packages are currently malicious. The vulnerability is the unsafe dependency acquisition and execution procedure. ### Attack Path 1. An attacker compromises a dependency publisher, package distribution channel, or package version ...[truncated 1396 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed version rather than resolving the latest available release: ```bash python -m pip install "solograph==REVIEWED_VERSION" python -m pip install "yt-dlp==REVIEWED_VERSION" ``` 2. Maintain a hash-locked requirements file and require hash verification: ```text solograph==REVIEWED_VERSION --hash=sha256:EXPECTED_HASH yt-dlp==REVIEWED_VERSION --hash=sha256:EXPECTED_HASH ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Document the canonical package repository and configure package installation to use only the intended trusted index. Avoid unreviewed extra indexes that could enable dependency confusion. 4. Replace unrestricted `uvx solograph` execution with a version-pinned invocation in an isolated environment. Do not download and immediately execute the latest package release. 5. Require explicit user confirmation before installing software or executing newly downloaded dependencies. 6. Run transcript-processing dependencies in a sandbox or container with: - No unnecessary credentials. - Read-only project access where possible. - A dedicated temporary output directory. - Restricted outbound network access. - No administrative privileges. 7. Establish a dependency update process that reviews release provenance and changes, updates pinned hashes, and performs security scanning before approving new versions. ]]>