T08 · Insecure Dependencies
- Location
SKILL.md:145- Finding
Automatic Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 145-152; duplicated at lines 337-344
Vulnerability Type: Supply-chain exposure through automatic, unpinned package installation
Risk Level: MediumVulnerable Code
bash # Check packages one by one and install any that are missing for pkg in openai-whisper python-pptx Pillow reportlab PyMuPDF python-docx; do pip show "$pkg" > /dev/null 2>&1 || pip install "$pkg" 2>&1 doneThe surrounding instructions make this environment check mandatory before each execution and direct the Agent to install every missing package automatically.
Technical Analysis
The Skill installs dependencies directly from the environment's configured Python package index without specifying exact versions, verifying cryptographic hashes, using a reviewed lockfile, or requiring user approval. The effective dependency content can therefore change after the Skill itself has been audited.
Python package installation may execute package build or installation logic with the privileges of the Agent process. If a configured package index is compromised, dependency resolution is redirected, or a future dependency release becomes malicious, installation can result in arbitrary local code execution. Installing into the active environment also weakens isolation and makes subsequent behavior non-reproducible.
The listed package names do not appear to be deliberate typosquatting attempts. The risk arises from mandatory installation of mutable, unverified third-party artifacts rather than evidence that any currently named package is malicious.
Attack Path
- A user invokes the Skill on a host where at least one listed dependency is absent.
- The Skill's mandatory environment check runs
pip showfor each dependency. - A missing dependency triggers
pip installwithout a pinned version or expected hash. pipresolves mutable content through the host's configured package index and network path.- A comp ...[truncated 935 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic package installation from the normal Skill execution path.
- Move dependency installation to a separate, explicit setup phase that requires informed user or administrator approval.
- Pin every direct and transitive dependency to an audited exact version.
- Generate a lockfile containing cryptographic hashes and install with hash enforcement, such as
pip install --require-hashes. - Install dependencies inside a dedicated virtual environment or sandbox rather than modifying the Agent's active global environment.
- Configure an approved package index and disable untrusted supplemental indexes.
- Download and scan dependency artifacts during a controlled build process, then deploy from an internal immutable artifact repository where possible.
- Run document conversion and transcription with least privilege and restrict access to unrelated files, secrets, and network resources.
- Remove the duplicated installation block at lines 337-344 so that future security changes cannot leave a conflicting legacy copy.