T08 · Insecure Dependencies
- Location
SKILL.md:39- Finding
Unpinned Third-Party Dependencies Installed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:39-44,SKILL.md:102-103,SKILL.md:190,references/pylsp-config.md:7-27, andreferences/pep8-guide.md:129-147
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: MediumVulnerable Code Snippets
SKILL.md:39-44:bash pip install python-lsp-server pip install python-lsp-server[all] pip install pylsp-mypy pip install pylsp-blackSKILL.md:102-103:bash pip install autoflake autoflake --remove-all-unused-imports --in-place --recursive .SKILL.md:190:bash pip install --upgrade python-lsp-serverreferences/pylsp-config.md:7-27:bash pip install python-lsp-server pip install python-lsp-server[all] # Code analysis pip install pylsp-mypy pip install pylsp-flake8 pip install pylsp-pylint # Formatting pip install pylsp-black pip install pylsp-autopep8 # Refactoring pip install pylsp-rope # Other pip install pylsp-isortreferences/pep8-guide.md:129-147:bash pip install black black file.py pip install autopep8 autopep8 --in-place --aggressive file.py pip install autoflake autoflake --remove-all-unused-imports --in-place file.py pip install isort isort file.pyTechnical Analysis
The installation instructions identify packages only by name and do not constrain them to reviewed versions or verify package hashes. They also do not provide a lockfile, require a trusted package index, or mandate an isolated environment.
Consequently, the effective code installed by these commands can change after the Skill has been reviewed. Python packages and their transitive dependencies may execute code during installation or when their console entry points are subsequently invoked. The unconditional
--upgradeinstruction further increases exposure by replacing an installed, potentially reviewed version with the latest ve ...[truncated 1584 chars]- Remediation
View remediation
Remediation Suggestions
- Pin every direct dependency to a reviewed version rather than installing an unconstrained latest release.
- Maintain a lockfile that captures transitive dependency versions.
- Generate and verify cryptographic hashes, and install with a command such as
pip install --require-hashes -r requirements.txt. - Install dependencies in a dedicated virtual environment or similarly isolated execution environment.
- Specify and validate the intended trusted package index; do not silently rely on arbitrary user-configured mirrors.
- Replace unconditional
pip install --upgradeguidance with an explicit, reviewed upgrade procedure. - Periodically scan locked dependencies for known vulnerabilities and update pins through a controlled review process.
- Separate optional dependencies into documented, pinned requirement groups so users install only the components they need.