T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:23
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:23-29` **Vulnerability Type**: Unpinned and unverified third-party dependency installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ## Requirement - argparse - datetime - volcengine-python-sdk - base64 - os If not exits ,you need pip it. ``` ### Technical Analysis The Skill instructs the Agent to install missing dependencies with `pip` but does not provide an exact package version, dependency lock file, cryptographic hashes, trusted package index, or package verification procedure. Consequently, the package resolved at installation time can differ from the package reviewed when the Skill was published. Python package installation can execute package-controlled build or installation logic. The requirements list also mixes the external `volcengine-python-sdk` dependency with Python standard-library modules such as `argparse`, `datetime`, `base64`, and `os`. The broad instruction to install anything missing could therefore cause mistaken package installation. This constitutes a supply-chain weakness rather than evidence that the currently referenced SDK is malicious. ### Attack Path 1. The Agent loads the Skill and attempts to execute `scripts/main.py`. 2. The external SDK is unavailable in the current environment. 3. Following `SKILL.md`, the Agent uses `pip` to install the missing dependency. 4. `pip` resolves mutable package content from an unspecified package index without validating a pinned version or hash. 5. A compromised release, malicious similarly named package, dependency-confusion package, or compromised transitive dependency executes installation or runtime code. 6. That code runs with the Agent process's privileges and can access data available to that process, including workspace files and environment-provided credentials. ### Impact Assessment Successful exploitation could permit arbitrary code execution under ...[truncated 613 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `volcengine-python-sdk` to a reviewed exact version. 2. Provide a lock file containing all transitive dependency versions. 3. Record and verify cryptographic hashes, and install with a command such as `pip install --require-hashes -r requirements.txt`. 4. Explicitly configure a trusted package index rather than relying on ambient `pip` configuration. 5. Remove `argparse`, `datetime`, `base64`, and `os` from the installation requirements because they are Python standard-library modules. 6. Replace the ambiguous “pip it” instruction with an exact, reviewed installation command. 7. Install dependencies in an isolated virtual environment using an unprivileged account. 8. Avoid exposing Jimeng credentials to package installation processes; inject narrowly scoped credentials only when running the audited image-generation script.