T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, line 14; reinforced by `agents/openai.yaml`, line 4 **Vulnerability Type**: Unpinned and unverified third-party dependency installation **Risk Level**: Medium **Vulnerable Code Snippets**: `SKILL.md`, line 14: ```bash pip install emq-cli ``` `agents/openai.yaml`, line 4: ```yaml default_prompt: "Use emq-cli via direct 'emq ...' commands after pip installation. Verify auth first, then choose domain commands (market/portfolio/quota/raw), and include concrete command lines with required flags." ``` ### Technical Analysis The skill instructs users or agents to install `emq-cli` without specifying an exact version, cryptographic hash, trusted package index, or other integrity constraint. Consequently, the package resolved at installation time can differ from the package that was reviewed when this skill was published. This creates a supply-chain exposure if the package distribution account or registry is compromised, a malicious release is published, or package resolution is redirected to an untrusted index. Because Python packages can execute code during installation or when imported and invoked, a malicious package version could run with the privileges of the user executing `pip`. The agent configuration reinforces installation as the expected workflow but does not require package provenance or integrity verification. The audit did not establish that the current `emq-cli` package is malicious; the confirmed issue is the unsafe, mutable dependency-installation practice. ### Attack Path 1. An attacker compromises the package publisher, package registry, dependency-resolution path, or configured Python package index. 2. The attacker publishes or serves a malicious version of `emq-cli`. 3. A user or agent follows the skill and runs `pip install emq-cli`. 4. `pip` resolves the attacker-controlled release because no version or hash is constrained. 5. Malicious c ...[truncated 1049 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `emq-cli` to a specific, reviewed version, for example: ```bash python -m pip install "emq-cli==<reviewed-version>" ``` 2. Distribute a requirements or lock file containing cryptographic hashes and require hash verification: ```text emq-cli==<reviewed-version> --hash=sha256:<verified-hash> ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Explicitly identify the trusted package repository and prevent fallback to untrusted or dependency-confusion-prone indexes. 4. Verify the package publisher, release provenance, signatures or attestations, and dependency tree before updating the pinned version. 5. Test updates in an isolated environment before deployment. 6. Prefer installation in a dedicated virtual environment or restricted container with only the filesystem, network, and credential access required for EMQ operations. 7. Update `agents/openai.yaml` so the default prompt requires the pinned, integrity-verified installation procedure rather than generic installation through `pip`.