T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unnecessary and Unverified Third-Party Dependency Surface
- Content
View full analysis
- Remediation
View remediation
Security audit
sichuan-cuisine
Security checks for vulnerabilities and agentic risk
Overview
The skill’s food-research instructions are coherent, but it ships a large unrelated Python dependency manifest that creates avoidable installation risk.
Review this before installing in any environment that automatically processes requirements.txt. The food guidance itself appears benign, but the dependency manifest should be removed or reduced to only necessary packages, preferably with hash-locked installs and an isolated non-privileged environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (31)
Known Vulnerable Dependency: Authlib==1.6.6 — 14 advisory(ies): CVE-2026-28490 (Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle); CVE-2026-28802 (Authlib: Setting `alg: none` and a blank signature appears to bypass signature v); CVE-2026-41425 (Authlib: Cross-site request forging when using cache) +11 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The requirements file pins Authlib to a version reported with multiple critical advisories including JWT/JWE verification and CSRF-related issues. In an agent stack that likely handles authentication, API tokens, or OAuth-style flows, a vulnerable auth library can directly enable token forgery, signature bypass, or account/session compromise.
- Content
Known Vulnerable Dependency: GitPython==3.1.45 — 16 advisory(ies): CVE-2026-78676 (GitPython: Dormant multi-line git-config values are corrupted into live injected); CVE-2026-67325 (GitPython: Command Injection via git long-option prefix abbreviation bypass of C); CVE-2026-73620 (GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagRefere) +13 more
Critical
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
GitPython is pinned to a version with multiple critical advisories including command injection and unsafe option forwarding. In an agent environment, repository cloning, checkout, or config inspection are common tasks, so compromised git argument handling can plausibly become arbitrary command execution.
- Content
Known Vulnerable Dependency: langchain-core==1.0.2 — 12 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa); CVE-2026-40087 (LangChain has incomplete f-string validation in prompt templates) +9 more
Critical
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
langchain-core is pinned to a version with multiple critical advisories including SSRF and template injection. In an agentic application, prompt templates, tool inputs, and URL processing often originate from users or upstream models, so these bugs can expose internal services, secrets, or permit unintended code-like behavior in templates.
- Content
Known Vulnerable Dependency: click==8.3.1 — 1 advisory(ies): CVE-2026-7246 (Pallets Click, versions 8.3.2 and below, contain a command injection vulnerabili)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
Click is pinned to a version flagged for command injection. Even though Click is often used for CLI parsing, agent or ops tooling may expose CLI wrappers or administrative scripts where crafted input could lead to command execution.
- Content
Known Vulnerable Dependency: cryptography==3.4.8 — 16 advisory(ies): CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +13 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
cryptography==3.4.8 is very old and carries multiple high-severity advisories including oracle and bundled OpenSSL issues. Because this stack includes auth, JWT, OAuth, and HTTPS-related libraries, weaknesses in core cryptographic primitives or linked OpenSSL components can undermine confidentiality and signature validation.
- Content
Known Vulnerable Dependency: httplib2==0.20.2 — 2 advisory(ies): CVE-2026-59939 (httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Respon); CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, htt)
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
httplib2 is flagged for decompression bomb denial-of-service. If the skill or supporting service fetches remote content, an attacker could induce excessive memory or CPU consumption via crafted compressed responses.
- Content
Known Vulnerable Dependency: idna==3.11 — 2 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA) for Python provides suppor)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
idna==3.11 is reported vulnerable to specially crafted IDNA input handling issues. This becomes relevant when the application validates or requests user-supplied internationalized hostnames, potentially enabling validation bypass, spoofing, or unexpected resolution behavior.
- Content
Known Vulnerable Dependency: langchain-openai==1.0.1 — 2 advisory(ies): GHSA-r7w7-9xr2-qq2r; PYSEC-2026-76
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
langchain-openai is identified with high-severity advisories and sits on the direct boundary between prompts, tool outputs, and model API calls. Vulnerabilities here can amplify prompt-driven attacks, expose secrets in telemetry, or weaken request isolation when interacting with the LLM provider.
- Content
Known Vulnerable Dependency: langgraph==1.0.2 — 2 advisory(ies): GHSA-g48c-2wqr-h844; PYSEC-2026-83
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
langgraph is a core orchestration component for agent workflows and is reported with high-severity advisories. A weakness in workflow execution or state transitions can let attacker-controlled prompts influence tool execution, state leakage, or unauthorized actions across agent steps.
- Content
Known Vulnerable Dependency: langgraph-checkpoint==3.0.0 — 4 advisory(ies): GHSA-fjqc-hq36-qh5p; GHSA-mhr3-j7m5-c7c9; PYSEC-2026-2573 +1 more
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
langgraph-checkpoint manages persisted agent state and is flagged with multiple high-severity advisories. Compromise of checkpoint handling can expose prior conversation state, tool results, or secrets and may allow tampering with workflow execution.
- Content
Known Vulnerable Dependency: langgraph-sdk==0.2.9 — 2 advisory(ies): GHSA-w39p-vh2g-g8g5; PYSEC-2026-2575
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
langgraph-sdk is reported vulnerable and may expose client/server interaction surfaces for agent orchestration. If exploited, an attacker could interfere with workflow control APIs, state access, or remote execution-related features.
- Content
Known Vulnerable Dependency: langsmith==0.4.39 — 7 advisory(ies): GHSA-3644-q5cj-c5c7; GHSA-f4xh-w4cj-qxq8; GHSA-rr7j-v2q5-chgv +4 more
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
langsmith often handles tracing, telemetry, prompts, and execution metadata; advisories here can lead to leakage of sensitive prompts, API keys, or intermediate tool outputs. In an agent system, observability backends frequently receive the most sensitive contextual data, making exploitation particularly risky.
- Content
Known Vulnerable Dependency: oauthlib==3.2.0 — 2 advisory(ies): GHSA-3pgj-pg6c-r5p7; PYSEC-2022-269
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
oauthlib==3.2.0 has known high-severity advisories affecting OAuth security properties. Since this skill stack includes authentication-oriented libraries, vulnerable OAuth handling can enable CSRF, token leakage, or authorization bypass in login or API delegation flows.
- Content
Known Vulnerable Dependency: orjson==3.11.5 — 1 advisory(ies): GHSA-hx9q-6w63-j58v
High
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
orjson is flagged by a high-severity advisory, which may affect parsing or serialization safety. In agent systems, JSON is often the boundary format for tool calls, state persistence, and API communication, so parser flaws can cause crashes, memory issues, or trust-boundary failures.
- Content
Known Vulnerable Dependency: Pygments==2.19.2 — 2 advisory(ies): GHSA-5239-wwwm-4pmq; PYSEC-2026-2987
High
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
Pygments is reported vulnerable; while often used for rendering or highlighting, a parser or rendering issue can still impact systems that display untrusted content in web or admin interfaces. If traces, logs, or generated reports render attacker-controlled text, this could become a client-side or service-level issue.
- Content
Known Vulnerable Dependency: PyJWT==2.10.1 — 13 advisory(ies): GHSA-752w-5fwx-jx9f; GHSA-993g-76c3-p5m4; GHSA-fhv5-28vv-h8m8 +10 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
PyJWT is pinned to a version with numerous high-severity advisories. Given the presence of Authlib and OAuth-related packages, vulnerable JWT parsing or signature validation can allow token forgery, claims bypass, or authentication failures with direct security impact.
- Content
Known Vulnerable Dependency: pytest==9.0.1 — 2 advisory(ies): GHSA-6w46-j5rx-g56g; PYSEC-2026-1845
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
pytest is generally a development dependency, but the pinned version is reported with high-severity advisories. If included in production images or used in automation processing untrusted test artifacts, it could still expand the attack surface, though risk is typically lower than runtime dependencies.
- Content
Known Vulnerable Dependency: python-apt==2.4.0+ubuntu4.1 — 2 advisory(ies): GHSA-pj65-3pf6-c5q4; GHSA-rp8m-h266-53jh
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
python-apt is flagged with high-severity advisories and can be dangerous if the environment exposes package-management functionality. In most agent deployments it may not be directly reachable, but if administrative tooling or container maintenance paths invoke it, compromise could affect the host system.
- Content
Known Vulnerable Dependency: requests==2.32.5 — 2 advisory(ies): GHSA-gc5v-m9x4-r6x2; PYSEC-2026-2275
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
requests is a ubiquitous network library and a high-severity vulnerability here affects many code paths at once. In an agent platform that may fetch URLs, APIs, or external resources based on user/model input, flaws in request handling can enable SSRF, credential leakage, or response parsing abuse.
- Content
Known Vulnerable Dependency: setuptools==80.9.0 — 2 advisory(ies): GHSA-h35f-9h28-mq5c; PYSEC-2026-3447
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
setuptools is primarily a build/install dependency, but known vulnerabilities can affect package installation or build-time execution. The risk is highest in CI/CD or dynamic plugin installation scenarios rather than ordinary runtime serving.
- Content
Known Vulnerable Dependency: starlette==0.49.3 — 10 advisory(ies): GHSA-82w8-qh3p-5jfq; GHSA-86qp-5c8j-p5mr; GHSA-jp82-jpqv-5vv3 +7 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
starlette is a web framework component directly exposed to inbound HTTP traffic and is pinned to a version with many advisories. Vulnerabilities here can affect request parsing, middleware boundaries, websockets, routing, or denial-of-service behavior in any FastAPI-based service.
- Content
Known Vulnerable Dependency: urllib3==2.6.3 — 4 advisory(ies): GHSA-mf9v-mfxr-j63j; GHSA-qccp-gfcp-xxvc; PYSEC-2026-141 +1 more
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
urllib3 is foundational for HTTP transport and is flagged with multiple advisories. Since many libraries in this stack depend on HTTP, a vulnerability here can have broad impact across outbound requests, TLS handling, connection pooling, and proxy behavior.
- Content
Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Known Vulnerable Dependency: wheel==0.45.1 — 2 advisory(ies): GHSA-8rrh-rw8j-w5fx; PYSEC-2026-2047
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
wheel is mainly part of packaging and installation workflows, but vulnerabilities there can affect supply-chain security, malicious package handling, or build-time compromise. It is less likely to be directly exploitable at runtime unless the application installs packages dynamically.
- Content
Known Vulnerable Dependency: zipp==1.0.0 — 2 advisory(ies): GHSA-jfmj-5v4g-7637; PYSEC-2026-2074
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
zipp==1.0.0 is extremely old and flagged with high-severity advisories. Archive and import-path handling bugs can lead to denial of service, path confusion, or exploitation in code paths that inspect packaged resources or archives.
- Content
Static analysis
No suspicious patterns detected.