T08 · Insecure Dependencies
Warning
- Location
SKILL.md:43- Finding
Unpinned Runtime Dependency Execution
- Content
View full analysis
ingest/`. ``` ```markdown - Use `uvx fulcra-api file list` to check the `ingest/` directory. Explicitly ignore the `_meta/` folder and any `.md` files. ``` ```markdown - **Retrieval:** Execute `uvx fulcra-api file download ./`. ``` ```markdown - Example commands: - `uvx fulcra-api file download ingest/NetflixViewingHistory.csv ./NetflixViewingHistory.csv` (if not already downloaded) - `uvx fulcra-api file upload ./NetflixViewingHistory.csv ingest/_meta/archive/artifact/20260625-143000_NetflixViewingHistory.csv` - **Safety Check:** Before deleting the original file, you MUST verify that the file was successfully uploaded to the archive path (e.g., `uvx fulcra-api file list ingest/_meta/archive/artifact/` or `uvx fulcra-api file stat ingest/_meta/archive/artifact/20260625-143000_NetflixViewingHistory.csv`). ``` From `references/fulcra-ingest-source-mapping.md`: ```markdown Use `uvx fulcra-api file download` to attempt to pull `ingest/_meta/source_map.md`. ``` ```markdown - Fall back to the standard Idempotency Check (run `uvx fulcra-api catalog` to see if a schema was created manually by the user). - If still not found, create the new schema via `uvx fulcra-api data-type create` (always use `--add-to-timeline`). ``` ```markdown - Save the Markdown file locally and upload it back to Fulcra using `uvx fulcra-api file upload ./source_map.md ingest/_meta/source_map.md`, overwriting the previous version. ``` ### Technical Analysis The Skill repeatedly invokes `fulcra-api` through `uvx` without specifying an exact package version, lockfile, package hash, or veri ...[truncated 1930 chars]- Remediation
View remediation