T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party Package Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 47-59 **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip install galileo ``` For evaluation features with the legacy prompt engineering interface: ```bash pip install promptquality ``` For runtime guardrails: ```bash pip install galileo-protect ``` ### Technical Analysis The primary installation instructions retrieve mutable latest versions of three third-party packages without version constraints, integrity hashes, or a locked dependency graph. Consequently, the code installed and executed can differ from the version reviewed when this Skill was authored. Python package installation can execute package build logic, while imported packages subsequently execute with the privileges of the consuming application. If a package release, maintainer account, transitive dependency, or configured package index is compromised, following these instructions could introduce attacker-controlled code. Ordinary upstream changes may also alter telemetry behavior or introduce incompatible or vulnerable dependencies. The separately documented `promptquality==1.14.0` constraint in `references/PROMPTQUALITY.md` reduces version drift for that alternative installation path, but the main installation instructions remain unpinned and do not verify package integrity. ### Attack Path 1. An attacker compromises a named package, one of its transitive dependencies, a maintainer publishing account, or the package index used by the environment. 2. The attacker publishes a malicious release that satisfies the unconstrained installation request. 3. A user or agent follows the documented `pip install` command. 4. `pip` resolves and downloads the attacker-controlled release because no reviewed version or hash is required. 5. Malicious build-time code executes during installation, or malicious runtime code executes w ...[truncated 695 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to a reviewed exact version, including `galileo`, `promptquality`, and `galileo-protect`. 2. Generate and maintain a lock file that also constrains transitive dependencies. 3. Record cryptographic hashes and install with `pip --require-hashes` where feasible. 4. Use a trusted or internally mirrored package index and explicitly configure the permitted index source. 5. Scan locked dependencies for known vulnerabilities and review updates before changing pins. 6. Install packages in an isolated virtual environment or container as a non-privileged user. 7. Reconcile the main installation guidance with the documented SDK compatibility matrix so users cannot accidentally install incompatible major versions. 8. Prefer a reviewed requirements file, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` The requirements file should contain approved exact versions and hashes rather than unconstrained package names.