T08 · Insecure Dependencies
Warning
- Location
- README.md:40
- Finding
- Unpinned Third-Party Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md:40-48` **Additional Locations**: `SKILL.md:65-74`, `references/kimi-k2.6-vision-api.md:132-136` **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Complete Code Snippet ```bash pip install pymupdf opencv-python pdfplumber openai ``` Optional system-level installation: ```bash sudo apt install tesseract-ocr ``` The API reference also recommends: ```bash python3 -m pip install 'openai>=1.0' ``` ### Technical Analysis The installation instructions retrieve packages without exact version constraints, package hashes, a lockfile, or a documented trusted package index. The broad `openai>=1.0` constraint is particularly permissive because it automatically accepts future releases that have not been reviewed by the Skill author. Python packages can execute installation and runtime code with the permissions of the user running `pip`. If a selected package release or its dependency chain is compromised, malicious code could execute when the package is installed or imported. The recommendation to invoke `sudo apt install` is legitimate for installing Tesseract and does not by itself constitute privilege escalation. However, system-wide dependency installation exceeds the privileges needed by the document-analysis process itself and should be clearly separated from ordinary Skill execution. No evidence was found that the named packages are currently malicious, that the Skill uses typosquatted package names, or that it configures an untrusted package repository. The finding concerns the absence of reproducible dependency controls. ### Attack Path 1. An attacker compromises a future release of one of the named packages or a transitive dependency. 2. A user follows the documented installation command without reviewing the resolved versions. 3. `pip` downloads the compromised release because no exact version or hash restricts package selection. 4. Mal ...[truncated 994 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Provide a reviewed dependency manifest with exact versions, such as: ```text pymupdf==<reviewed-version> opencv-python==<reviewed-version> pdfplumber==<reviewed-version> openai==<reviewed-version> ``` 2. Generate and publish cryptographic hashes for all direct and transitive dependencies, then require hash verification during installation: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lockfile generated by a reproducible dependency-management tool. 4. Test dependency updates before changing the locked versions. 5. Recommend installation inside a dedicated virtual environment or container running without elevated privileges. 6. Document the expected package index and discourage unreviewed mirrors. 7. Separate optional operating-system setup from Skill execution and explain that the Skill itself does not require continuing administrator privileges. 8. Add automated dependency and vulnerability scanning to the release process. ]]>