T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:168
- Finding
- Unpinned Third-Party Package Installation Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:168-172` **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### Installation ```bash pip install adata ``` ``` ### Technical Analysis The Skill instructs users or an AI Agent to install `adata` directly from the package index without specifying an audited version, verifying cryptographic hashes, using a lockfile, or documenting a trusted source. Because package installation can execute package-controlled build and installation logic, the effective code installed by this command can change after the Skill has been reviewed. A compromised package-owner account, malicious future release, package-index compromise, or dependency-chain compromise could therefore introduce attacker-controlled code. The finding does not establish that the current `adata` package is malicious. The vulnerability is the absence of controls that ensure the installed artifact is the same artifact that was reviewed. ### Attack Path 1. An attacker compromises the package publisher, publishing process, package-index account, or one of the package's transitive dependencies. 2. The attacker publishes a malicious release under the expected package name. 3. A user or Agent follows the Skill's instruction and runs `pip install adata`. 4. Pip resolves the package version available at installation time rather than a previously audited version. 5. Malicious package code executes during installation, import, or subsequent SDK use. 6. The payload operates with the privileges of the account running pip or Python. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the invoking user's permissions. Depending on those permissions and the host environment, the compromised package could access files, environment variables, application credentials, network resources, and data available to the Python process. The direct scope ...[truncated 339 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `adata` to a specifically reviewed version rather than installing the latest available release: ```bash python -m pip install "adata==<reviewed-version>" ``` 2. Obtain the package from its verified official source and document the expected publisher and repository. 3. Download and review the exact distribution artifact before recommending it. 4. Record cryptographic hashes in a requirements file and enforce them: ```text adata==<reviewed-version> --hash=sha256:<verified-hash> ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Pin and hash all transitive dependencies using a lockfile or reproducible dependency-management process. 6. Install the package in an isolated virtual environment or container under an unprivileged account. 7. Add automated dependency vulnerability, provenance, and integrity checks to the release-review process. ]]>