T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned AT Protocol Dependency Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:13-16` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Vulnerable Code**: ```json { "id": "python-atproto", "kind": "pip", "package": "atproto", "label": "Install AT Protocol Python SDK" } ``` The setup instructions at `SKILL.md:35` also use an unpinned installation command: ```bash pip install atproto ``` ### Technical Analysis The Skill installs `atproto` without specifying a reviewed version, lock file, or package integrity hash. Consequently, installation resolves whichever compatible package and transitive dependencies are available from the configured Python package index at installation time. This does not establish that the current `atproto` package is malicious. However, it makes the audited artifact non-reproducible and allows its effective executable dependency set to change after review. A compromised future release, compromised package-index account, or malicious package served through an unsafe package-index configuration could execute installation or import-time code with the privileges of the Agent process. Because `lib/bluesky_agent.py` imports this dependency directly, malicious code in the package could run when the module is imported: ```python from atproto import Client, client_utils, models ``` ### Attack Path 1. An attacker compromises the upstream package, a transitive dependency, a package publisher account, or the package index used by the deployment. 2. The attacker publishes or serves a malicious version that still satisfies the unrestricted `atproto` requirement. 3. A user installs the Skill dependency with the declared installation configuration or `pip install atproto`. 4. The malicious package executes during installation or when `bluesky_agent.py` imports it. 5. The package acts with the permissions of the installation or Agent process and may access data available to t ...[truncated 530 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `atproto` to a specifically reviewed version, such as an exact `==` version rather than an unrestricted package name. 2. Generate and commit a lock file that fixes all transitive dependency versions. 3. Require package hashes during installation, for example through a hash-locked requirements file and `pip install --require-hashes`. 4. Install only from an explicitly configured, trusted package index. 5. Use automated dependency monitoring, but review updates before modifying the pinned version. 6. Run dependency installation and the Skill with least privilege in an isolated virtual environment or container. 7. Record the reviewed package versions and hashes in the release documentation so installations are reproducible.