T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Dependencies Installed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:35` **Vulnerability Type**: Supply-chain risk from unpinned dependencies **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash pip install pytesseract Pillow ``` ### Technical Analysis The documented installation command retrieves the latest package versions matching their names from the Python package index configured in the user's environment. It does not pin reviewed versions, verify cryptographic hashes, or require a trusted package source. The minimum-version constraints in `_meta.json` do not provide reproducible dependency resolution: ```json "pytesseract": ">=0.3.0", "Pillow": ">=8.0.0" ``` Consequently, the code installed by users can change after this Skill has been reviewed. If an allowed dependency, its transitive dependencies, or the configured package repository is compromised, attacker-controlled code may be installed. Package installation and subsequent imports can execute that code in the user's environment. ### Attack Path 1. An attacker compromises a permitted package release, one of its transitive dependencies, or the package index configured for `pip`. 2. A user follows the installation instructions and runs `pip install pytesseract Pillow`. 3. Because no exact versions or hashes are required, `pip` resolves and downloads the compromised package. 4. Attacker-controlled package code executes during installation, import, or later OCR operations. 5. The malicious code operates with the privileges of the account or environment that installed and runs the Skill. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the installing or invoking user's privileges. Depending on that account's permissions, the attacker could read or modify accessible files, steal environment variables or credentials, alter the Python environment, and compromise OCR input or output. If installation is performed with ...[truncated 309 chars]
- Remediation
- ## Remediation Suggestions 1. Create a reviewed lock file or requirements file containing exact versions for direct and transitive dependencies. 2. Record cryptographic hashes and require verification during installation, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Replace open-ended constraints such as `>=0.3.0` with versions synchronized with the reviewed lock file. 4. Configure and document an approved HTTPS package index or an internally controlled dependency mirror. 5. Perform dependency vulnerability and provenance checks before updating locked versions. 6. Install dependencies inside an isolated virtual environment under a non-privileged account, and explicitly discourage using `sudo pip`. 7. Establish a controlled update process in which dependency changes are reviewed, scanned, tested, and assigned new hashes before release.