T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:28
- Finding
- Automatic Installation of Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-42`, `requirements.txt:1-4`, `package.json:5-10`, `README.md:28-69` **Vulnerability Type**: Supply-chain exposure through automatic installation of unpinned dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:28-42`: ```markdown **Dependency check and automatic installation:** After selecting the runtime, check whether dependencies are installed. If they are missing, install them automatically without asking the user: - **Python**: ```bash pip install -r requirements.txt ``` - **Node.js**: ```bash npm install ``` ``` `requirements.txt:1-4`: ```text zxingcpp Pillow openpyxl qrcode ``` `package.json:5-10`: ```json "dependencies": { "qrcode": "^1.5.0", "qr-scanner-wechat": "^0.1.0", "sharp": "^0.33.0", "xlsx": "^0.18.0", "archiver": "^7.0.0" } ``` ### Technical Analysis The Skill explicitly directs the Agent to install missing dependencies without obtaining user confirmation. All Python dependencies are unpinned, while the npm manifest uses caret ranges and has no accompanying lockfile. No integrity hashes are supplied for Python packages. Consequently, the code installed during first use may differ from the code originally reviewed. Package installation can execute package lifecycle or build logic with the privileges of the Agent process. This creates exposure to compromised package releases, dependency takeover, malicious transitive dependencies, and unexpected incompatible updates. The audit did not establish that any currently named package is malicious. The vulnerability is the unsafe dependency acquisition process and absence of reproducible dependency constraints. ### Attack Path 1. An attacker compromises a direct or transitive dependency, its maintainer account, or its distribution channel. 2. The attacker publishes a malicious version that satisfies the unpinned Python requirement or npm caret range. 3. A user invokes the Skill on a system ...[truncated 707 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before installing or updating dependencies. 2. Pin every direct Python dependency to a reviewed exact version. 3. Generate a hash-locked Python requirements file and install with `pip install --require-hashes`. 4. Commit an npm lockfile and use `npm ci` instead of `npm install`. 5. Pin npm dependencies to reviewed exact versions rather than caret ranges. 6. Review and lock transitive dependencies. 7. Where operationally possible, disable npm lifecycle scripts with `--ignore-scripts`. 8. Install dependencies in an isolated virtual environment or container with minimal filesystem and network permissions. 9. Add automated dependency vulnerability and provenance scanning to the release process. ]]>