T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Dependencies Permit Unsafe Package Resolution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-37`; `skill.json:7` **Vulnerability Type**: Unpinned and integrity-unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:35-37`: ```bash pip install akshare pandas numpy jieba snownlp ``` `skill.json:7`: ```json "dependencies": ["akshare", "pandas", "numpy", "jieba", "snownlp"], ``` ### Technical Analysis The project instructs users to install five third-party packages without fixed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, package resolution is mutable: the same installation command can retrieve different artifacts at different times. Python packages can execute build-backend or installation logic during installation, and their code runs when imported or invoked. If a listed package, its publisher account, its distribution process, or the configured package index is compromised, installation may introduce attacker-controlled code without requiring a change to this repository. The manifest also lists packages that are not used by the current implementation, unnecessarily increasing the supply-chain attack surface. The audited script directly imports only `pandas` and `numpy`; the documented packages `akshare`, `jieba`, and `snownlp` are not imported by the present implementation. No evidence was found that any currently listed package is malicious. This finding concerns the unsafe and non-reproducible dependency resolution mechanism. ### Attack Path 1. An attacker compromises a listed package, a maintainer account, a package release pipeline, or a package index used by the installer. 2. The attacker publishes a malicious release under one of the dependency names. 3. A user follows the documented unpinned `pip install` command, or an agent installs dependencies from `skill.json`. 4. The resolver selects the attacker-controlled release because no approved version or artifact hash is enforced. 5. M ...[truncated 833 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove dependencies that the implementation does not require, especially `akshare`, `jieba`, and `snownlp` unless their associated functionality is implemented and reviewed. 2. Pin every direct dependency to a reviewed exact version, such as `package==X.Y.Z`. 3. Generate and commit a lockfile containing resolved transitive dependencies. 4. Enforce cryptographic hashes for downloaded artifacts, for example through a hash-locked requirements file and `pip install --require-hashes`. 5. Install only from an explicitly configured, trusted package index; disable unintended fallback indexes where practical. 6. Review dependency provenance, release history, maintainer changes, known vulnerabilities, and transitive dependencies before updating pins. 7. Perform dependency installation and execution in an isolated, least-privilege environment without unnecessary secrets or filesystem access. 8. Add automated dependency vulnerability and integrity scanning to the release process. 9. Keep `SKILL.md` and `skill.json` synchronized so that both declare the same reviewed and pinned dependency set. ]]>