T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Package Installed at Runtime## Vulnerability Details **File Location**: `SKILL.md`, lines 27–32 **Vulnerability Type**: Unpinned runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```python # Auto-install dependency to ensure zero-setup for the user try: from perplexity import AsyncPerplexity except ImportError: print("Installing perplexityai...") subprocess.check_call([sys.executable, "-m", "pip", "install", "perplexityai", "-q"]) from perplexity import AsyncPerplexity ``` ### Technical Analysis The Skill instructs the agent to install `perplexityai` from the default Python package index whenever the module is unavailable. The dependency has no pinned version, cryptographic hash, lockfile, or verified package source. Consequently, the code reviewed in the Skill does not fully define the code that will execute at runtime. Package installation and import can execute package-controlled code with the same permissions as the Python process. A compromised package release, compromised transitive dependency, or unexpected future update could therefore access resources available to the agent. This is especially sensitive because the runtime is expected to expose `PERPLEXITY_API_KEY`. Although installing the official client supports the declared research functionality, automatic unverified installation is not the minimum-privilege implementation. The dependency should be provisioned and audited before the Skill runs. ### Attack Path 1. An attacker compromises a future `perplexityai` release or one of its transitive dependencies. 2. A user invokes the Skill in an environment where the `perplexity` module is not installed. 3. The `ImportError` handler executes `pip install perplexityai` without a version or hash constraint. 4. The compromised package or dependency executes installation-time or import-time code with the agent process's permissions. 5. That code accesses available resources, potentially includ ...[truncated 808 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic package installation from the Skill execution workflow. 2. Preinstall the dependency in a controlled, sandboxed runtime image. 3. Pin the dependency and all transitive dependencies to reviewed versions using a lockfile. 4. Require cryptographic hashes, such as pip's `--require-hashes`, for every downloaded artifact. 5. Use an approved package repository or internal mirror with provenance and integrity controls. 6. Scan and review dependency updates before deployment rather than resolving the latest release at runtime. 7. Run the Skill as an unprivileged user with a read-only filesystem wherever practical. 8. Restrict network egress to the package source during image construction and to the required Perplexity API endpoint during execution. 9. Expose `PERPLEXITY_API_KEY` only to the search process and avoid placing unrelated credentials in the same environment.