T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Excessive and Unverified Third-Party Dependency Set
- Content
View full analysis
- Remediation
View remediation
Security audit
sichuan-cuisine-rd
Security checks for vulnerabilities and agentic risk
Overview
The skill content is a normal Sichuan food R&D guide, but it ships an unexplained large Python dependency file that does not fit a Markdown-only skill.
Review before installing. The instructional content appears benign, but do not run or install artifact/requirements.txt unless the publisher explains why these packages are needed, minimizes them, and provides a reviewed lock file with hashes. Food-safety and regulatory advice should also be checked against the user's actual jurisdiction and qualified professionals for production use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (31)
Known Vulnerable Dependency: Authlib==1.6.6 — 14 advisory(ies): CVE-2026-28490 (Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle); CVE-2026-28802 (Authlib: Setting `alg: none` and a blank signature appears to bypass signature v); CVE-2026-41425 (Authlib: Cross-site request forging when using cache) +11 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The requirements file pins Authlib to a version flagged with multiple severe advisories, including JWT/JWE verification and cryptographic oracle issues. In an agent stack that may rely on OAuth, tokens, or identity federation, this can enable authentication bypass, token forgery, or cryptographic attacks if the vulnerable code paths are used.
- Content
Known Vulnerable Dependency: GitPython==3.1.45 — 16 advisory(ies): CVE-2026-78676 (GitPython: Dormant multi-line git-config values are corrupted into live injected); CVE-2026-67325 (GitPython: Command Injection via git long-option prefix abbreviation bypass of C); CVE-2026-73620 (GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagRefere) +13 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
GitPython is pinned to a version with multiple critical advisories including command injection and unsafe option forwarding. In agent systems that may inspect repositories, load code, or interact with Git metadata, these flaws can permit arbitrary command execution or malicious repository-triggered behavior.
- Content
Known Vulnerable Dependency: langchain-core==1.0.2 — 12 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa); CVE-2026-40087 (LangChain has incomplete f-string validation in prompt templates) +9 more
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
langchain-core has multiple critical advisories including SSRF, template injection, and incomplete prompt/template validation. Because this project appears to be an agent skill that likely processes untrusted prompts and URLs, these flaws are particularly dangerous and can lead to internal network access, prompt abuse, or arbitrary file/data exposure.
- Content
Known Vulnerable Dependency: click==8.3.1 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)
High
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
Click is pinned to a version reported as vulnerable to command injection. If this skill or its supporting tooling exposes CLI wrappers, passes untrusted input into Click-based commands, or uses administrative scripts in deployment pipelines, exploitation could lead to arbitrary command execution.
- Content
Known Vulnerable Dependency: cryptography==3.4.8 — 16 advisory(ies): CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +13 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Cryptography 3.4.8 is very old and carries multiple advisories, including Bleichenbacher-style timing/oracle risks and bundled OpenSSL concerns. Because this stack includes OAuth, JWT, HTTPS, and agent integrations, weak cryptographic behavior can undermine confidentiality, integrity, and trust boundaries.
- Content
Known Vulnerable Dependency: httplib2==0.20.2 — 2 advisory(ies): CVE-2026-59939 (httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Respon); CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, htt)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
httplib2 is flagged for decompression bomb denial-of-service via unbounded compressed responses. If the skill fetches remote content, an attacker-controlled endpoint could exhaust memory or CPU and disrupt service availability.
- Content
Known Vulnerable Dependency: idna==3.11 — 2 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA) for Python provides suppor)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The pinned idna version is reported vulnerable to specially crafted IDNA inputs. In a networked agent environment, malformed internationalized hostnames can lead to parsing inconsistencies, policy bypass, or destination validation errors in URL handling.
- Content
Known Vulnerable Dependency: langchain-openai==1.0.1 — 2 advisory(ies): GHSA-r7w7-9xr2-qq2r; PYSEC-2026-76
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
langchain-openai is pinned to a version with published high-severity advisories. Given its role at the boundary between untrusted prompts and model/tool execution, flaws here can amplify prompt-injection, request-routing, or data exposure risks in the agent runtime.
- Content
Known Vulnerable Dependency: langgraph==1.0.2 — 2 advisory(ies): GHSA-g48c-2wqr-h844; PYSEC-2026-83
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
langgraph is reported vulnerable by published advisories and is central to orchestration/state management for agent workflows. Vulnerabilities in orchestration layers can expose checkpoints, alter control flow, or enable unsafe execution paths when handling attacker-controlled conversation state.
- Content
Known Vulnerable Dependency: langgraph-checkpoint==3.0.0 — 4 advisory(ies): GHSA-fjqc-hq36-qh5p; GHSA-mhr3-j7m5-c7c9; PYSEC-2026-2573 +1 more
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
langgraph-checkpoint handles agent state persistence and is flagged with multiple high-severity advisories. In an agent system, checkpoint flaws can leak prior conversations, enable tampering with execution state, or permit deserialization/storage abuse.
- Content
Known Vulnerable Dependency: langgraph-sdk==0.2.9 — 2 advisory(ies): GHSA-w39p-vh2g-g8g5; PYSEC-2026-2575
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
langgraph-sdk is a client/control plane component with reported vulnerabilities. If used to interact with remote orchestration services, weaknesses here can compromise control channels, expose metadata, or allow unsafe request handling.
- Content
Known Vulnerable Dependency: langsmith==0.4.39 — 7 advisory(ies): GHSA-3644-q5cj-c5c7; GHSA-f4xh-w4cj-qxq8; GHSA-rr7j-v2q5-chgv +4 more
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
langsmith is flagged by several advisories and often handles tracing, telemetry, prompts, and run metadata. In an LLM agent environment, vulnerable observability components can leak sensitive prompts, secrets, or execution traces and may become an attack surface for data exfiltration.
- Content
Known Vulnerable Dependency: oauthlib==3.2.0 — 2 advisory(ies): GHSA-3pgj-pg6c-r5p7; PYSEC-2022-269
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
oauthlib 3.2.0 has known high-severity advisories affecting OAuth handling. Since this dependency is directly tied to authorization flows, exploitation can lead to token leakage, improper redirect/validation behavior, or authentication bypass depending on usage.
- Content
Known Vulnerable Dependency: orjson==3.11.5 — 1 advisory(ies): GHSA-hx9q-6w63-j58v
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
orjson is pinned to a version with a published high-severity advisory. Serialization libraries sit on critical trust boundaries, and a flaw here may enable denial of service, parsing inconsistencies, or memory-safety issues depending on the advisory and usage.
- Content
Known Vulnerable Dependency: Pygments==2.19.2 — 2 advisory(ies): GHSA-5239-wwwm-4pmq; PYSEC-2026-2987
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Pygments is reported vulnerable by current advisories. If the service renders or highlights attacker-controlled content, parser bugs can trigger denial of service or content-processing issues in downstream interfaces.
- Content
Known Vulnerable Dependency: PyJWT==2.10.1 — 13 advisory(ies): GHSA-752w-5fwx-jx9f; GHSA-993g-76c3-p5m4; GHSA-fhv5-28vv-h8m8 +10 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
PyJWT is pinned to a version associated with multiple advisories. JWT libraries are security-critical; flaws can permit signature bypass, weak algorithm acceptance, claim validation failures, or token confusion attacks in authentication and service-to-service trust.
- Content
Known Vulnerable Dependency: pytest==9.0.1 — 2 advisory(ies): GHSA-6w46-j5rx-g56g; PYSEC-2026-1845
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
pytest is normally a development dependency, but pinning a vulnerable version still poses risk in CI pipelines, test environments, or if dev dependencies are bundled into runtime images. Exploitation is less likely in production request paths, but it remains a real supply-chain and tooling issue.
- Content
Known Vulnerable Dependency: python-apt==2.4.0+ubuntu4.1 — 2 advisory(ies): GHSA-pj65-3pf6-c5q4; GHSA-rp8m-h266-53jh
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
python-apt is flagged with high-severity advisories and interacts with package-management functions. If present in privileged environments, vulnerabilities here may expose package metadata, trust decisions, or local privilege-related attack surface.
- Content
Known Vulnerable Dependency: requests==2.32.5 — 2 advisory(ies): GHSA-gc5v-m9x4-r6x2; PYSEC-2026-2275
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
requests is a core HTTP client and the pinned version carries high-severity advisories. In an agent that may fetch URLs, call APIs, or process user-supplied endpoints, HTTP client flaws can enable SSRF bypasses, header/request smuggling issues, or certificate/redirect handling weaknesses.
- Content
Known Vulnerable Dependency: setuptools==80.9.0 — 2 advisory(ies): GHSA-h35f-9h28-mq5c; PYSEC-2026-3447
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
setuptools is flagged by published advisories and is part of the build/install trust chain. Vulnerabilities here can affect package installation, build hooks, or dependency resolution, creating supply-chain exposure especially in CI/CD or dynamic package operations.
- Content
Known Vulnerable Dependency: starlette==0.49.3 — 10 advisory(ies): GHSA-82w8-qh3p-5jfq; GHSA-86qp-5c8j-p5mr; GHSA-jp82-jpqv-5vv3 +7 more
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Starlette is the web framework layer for request parsing, routing, middleware, and response handling; the pinned version has multiple high-severity advisories. Vulnerabilities here can directly affect internet-facing attack surface through request smuggling, denial of service, auth/session issues, or middleware bypass.
- Content
Known Vulnerable Dependency: urllib3==2.6.3 — 4 advisory(ies): GHSA-mf9v-mfxr-j63j; GHSA-qccp-gfcp-xxvc; PYSEC-2026-141 +1 more
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
urllib3 underpins HTTP transport for many clients and is pinned to a version with several advisories. Transport-layer bugs can undermine TLS handling, redirect behavior, connection pooling, or request parsing across a large portion of the stack.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Known Vulnerable Dependency: wheel==0.45.1 — 2 advisory(ies): GHSA-8rrh-rw8j-w5fx; PYSEC-2026-2047
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
wheel is part of the packaging toolchain and is reported vulnerable by current advisories. While usually not directly exposed at runtime, vulnerable build tooling can still enable supply-chain compromise during packaging, CI, or deployment workflows.
- Content
Known Vulnerable Dependency: zipp==1.0.0 — 2 advisory(ies): GHSA-jfmj-5v4g-7637; PYSEC-2026-2074
High
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
zipp 1.0.0 is extremely old and carries advisories; ZIP/archive handling bugs often lead to path traversal, denial of service, or parsing issues. If any package, plugin, or artifact processing uses this library transitively, archive-based attacks may become possible.
- Content
Static analysis
No suspicious patterns detected.