T08 · Insecure Dependencies
- Location
SKILL.md:43- Finding
Unpinned Third-Party Package Installation Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 43-50 and 64-71
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: MediumVulnerable Code
python # 使用 selenium pip install selenium from selenium import webdriver driver = webdriver.Chrome() driver.get("https://flight.qunar.com/")bash # 使用 12306 API 封装 pip install py12306 from py12306 import Py12306 client = Py12306() trains = client.query("上海", "北京", "2026-02-20")Technical Analysis
The skill instructs users or agents to install
seleniumandpy12306directly from the configured Python package index without pinning versions, validating cryptographic hashes, providing a lockfile, or documenting an approved source.Consequently, the effective code installed by these commands can change after the skill has been reviewed. If a package release, maintainer account, package registry, or transitive dependency is compromised,
pipmay retrieve attacker-controlled content. Python packages can execute package-controlled build hooks during installation, and the documented imports subsequently execute package initialization code.No evidence in the audited files establishes that either named package is currently malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition process.
Attack Path
- An attacker compromises a referenced package, one of its transitive dependencies, its publishing account, or the package source used by
pip. - The attacker publishes a malicious version that remains compatible with the unrestricted package name.
- A user or agent follows the instructions and runs
pip install seleniumorpip install py12306. pipresolves and downloads the attacker-controlled release because no approved version or hash is specified.- Malicious code executes through package build/install hooks or when the package is imported by the do ...[truncated 572 chars]
- An attacker compromises a referenced package, one of its transitive dependencies, its publishing account, or the package source used by
- Remediation
View remediation
Remediation Suggestions
- Replace unrestricted package installation commands with exact, security-reviewed version pins.
- Maintain dependencies in a lockfile generated from an approved package source.
- Record and validate cryptographic hashes, and install with
pip --require-hashes. - Pin and review transitive dependencies rather than validating only top-level package names.
- Document the authoritative package repository and reject unexpected indexes or dependency sources.
- Periodically scan pinned versions for known vulnerabilities and update them through a controlled review process.
- Run installation and travel-query code in an isolated virtual environment or container under a non-privileged account.
- Avoid administrator-level or system-wide package installation.
- Verify that
py12306is the intended maintained package and provide its reviewed provenance because the current documentation supplies no source or integrity information.