T08 · Insecure Dependencies
Warning
- Location
SKILL.md:44- Finding
Unpinned Third-Party Dependency Installation and Execution
- Content
View full analysis
/dev/null 2>&1 && echo "yt-dlp: ok" || echo "Install: pip install yt-dlp" ``` ```markdown ### yt-dlp not found **Fix:** `pip install yt-dlp` or `brew install yt-dlp` ### No subtitles available **Cause:** Video has no auto-generated or manual captions. **Fix:** Try `--sub-lang en,ru` for multiple languages. Some videos only have auto-generated subs. ### solograph MCP not available **Fix:** Skills work in standalone mode (yt-dlp + Read). For indexed search across many videos, install solograph: `pip install solograph`. For enhanced web search, set up [SearXNG](https://github.com/fortunto2/searxng-docker-tavily-adapter) (private, self-hosted, free). ``` ### Technical Analysis The Skill instructs the user or Agent to install `solograph` and `yt-dlp` directly from mutable package registries without specifying reviewed versions, cryptographic hashes, a lockfile, or a trusted package index. Consequently, the dependency resolved during a future invocation may differ from the dependency available when the Skill was audited. The `uvx solograph` alternative is particularly sensitive because `uvx` obtains the package and immediately runs its entry point. A compromised package version, compromised publisher account, registry substitution, or malicious package selected through repository configuration could therefore introduce executable code into the Agent environment. The audit did not find evidence that the named packages are currently malicious. The vulnerability is the unsafe dependency acquisition and execution procedure. ### Attack Path 1. An attacker compromises a dependency publisher, package distribution channel, or package version ...[truncated 1396 chars]- Remediation
View remediation