T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:74
- Finding
- Unpinned Remote Dependencies and Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 74–88 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # 1. 克隆仓库 git clone https://github.com/CYF2000127/RxnIM cd RxnIM # 2. 创建环境 conda create -n rxnim python=3.10 conda activate rxnim # 3. 安装依赖 pip install -r requirements.txt # 4. 下载模型权重（~14GB） # https://huggingface.co/datasets/CYF200127/RxnIM → RxnIM-7b.zip # 解压到本地路径，修改 config/_base_/dataset/DEFAULT_TRAIN_DATASET.py 中的路径 # 5. 推理 sh eval.sh ``` ### Technical Analysis The documented installation procedure clones the current state of a mutable external Git repository without pinning it to a reviewed commit or release. It then installs packages from the repository-controlled `requirements.txt` and executes the repository-controlled `eval.sh`. Neither the external repository files nor its transitive dependencies are included in the audited artifact. Their effective behavior can therefore change after this Skill has been reviewed. Python package installation may execute arbitrary build hooks, while the shell script can execute arbitrary commands directly. The separately downloaded model archive is also not protected by a documented checksum or signature. This creates a supply-chain trust boundary in which compromise of the repository, a referenced package, its package registry account, or the model distribution can result in local code execution. ### Attack Path 1. An attacker compromises the referenced repository, one of its dependency sources, or the model distribution account. 2. The attacker alters `requirements.txt`, substitutes a malicious package or version, modifies `eval.sh`, or replaces a model artifact with an unsafe file. 3. A user follows the local deployment instructions and clones the unpinned repository. 4. `pip install -r requirements.txt` executes malicious package installation or build logic, or `sh eval.sh` directly executes attacker-controlled shell commands. ...[truncated 817 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the external repository to a specific reviewed commit hash or cryptographically signed release rather than cloning the mutable default branch. 2. Provide a dependency lock file containing exact versions and verified hashes. Install dependencies with hash enforcement, such as `pip install --require-hashes`. 3. Review and vendor security-critical installation and inference scripts within the Skill package, or invoke a narrowly scoped, documented Python entry point instead of an externally mutable shell script. 4. Publish SHA-256 checksums or cryptographic signatures for model archives and require verification before extraction or loading. 5. Prefer non-executable model formats such as `safetensors`. Avoid loading untrusted pickle-based checkpoints or require explicitly safe deserialization settings. 6. Run installation and inference in an isolated environment, such as a dedicated container or unprivileged virtual machine, with no unnecessary credentials, host mounts, or network permissions. 7. Add an explicit warning that external repository code and model artifacts must be reviewed and verified before execution. 8. Use automated dependency and repository monitoring to detect compromised packages, vulnerable versions, or unexpected changes to pinned artifacts. ]]>