T08 · Insecure Dependencies
Warning
- Location
SKILL.md:17- Finding
Unpinned Third-Party Python Dependencies
- Content
View full analysis
/dev/null | ssh-keygen -lf - -E md5 # Or use a dedicated scanner: # pip install ssh-audit ssh-audit target.onion ``` ### Technical Analysis The Skill recommends installing `shodan`, `Pillow`, and `ssh-audit` directly from the configured Python package index without version constraints or cryptographic hash verification. Package installation can execute package-controlled build and installation logic with the privileges of the invoking user. The package names appear legitimate, and the audit found no evidence that the Skill intentionally references a typosquatted or attacker-controlled package. Nevertheless, unconstrained installation means the effective dependency contents can change after the Skill has been reviewed. A compromised maintainer account, malicious future release, package-index compromise, or dependency substitution could therefore introduce arbitrary code. This behavior is not required at unrestricted scope. The declared OSINT functionality can be retained while installing only reviewed, reproducible package versions. ### Attack Path 1. A user follows the Skill's prerequisite or SSH auditing instructions. 2. The user runs an unpinned `pip install` command. 3. The configured package index resolves the name to the latest available release. 4. A compromised or malicious release supplies altered build or installation logic. 5. `pip` executes that logic during installation. 6. The malicious package obtains the same operating-system privileges and accessible data as the user running `pip`. ### Impact Assessment ...[truncated 527 chars]- Remediation
View remediation