T08 · Insecure Dependencies
Warning
- Location
- skill.md:14
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `skill.md`, lines 14-17 and 40-43 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Vulnerable code:** ```yaml dependencies: python: - "zhipuai>=2.1.0" install_command: "pip install zhipuai" ``` ```bash pip install zhipuai ``` ### Technical Analysis The dependency declaration accepts every `zhipuai` release at or above version 2.1.0, while the documented installation command imposes no version constraint at all. The project also provides no lockfile, package hash verification, trusted index restriction, or artifact signature validation. Consequently, the dependency resolved during installation may differ from the version reviewed when this Skill was published. If a future release or package-distribution account is compromised, installation or subsequent import of the package could execute attacker-controlled code. This is a supply-chain exposure rather than evidence that the current `zhipuai` package is malicious. ### Attack Path 1. An attacker compromises the package publisher, distribution account, package index, or a future eligible release. 2. The attacker publishes a malicious version that satisfies `zhipuai>=2.1.0`. 3. A user follows the Skill's `pip install zhipuai` instruction. 4. Pip resolves and installs the attacker-controlled release. 5. Malicious package code executes during an applicable build or installation process, or when the package is imported by the example code. 6. The code operates with the privileges of the user running pip or Python and may access available environment variables, including `ZHIPUAI_API_KEY`, as well as files and documents accessible to that user. ### Impact Assessment Successful exploitation could result in arbitrary code execution with the installing or invoking user's privileges. The affected scope may include theft of `ZHIPUAI_API_KEY`, unauthorized API usage, disclosure or ...[truncated 211 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the open-ended constraint with an exact, reviewed version, for example: ```yaml dependencies: python: - "zhipuai==<reviewed-version>" install_command: "python -m pip install zhipuai==<reviewed-version>" ``` 2. Generate and maintain a lockfile containing hashes for the package and all transitive dependencies. 3. Enforce hash verification during installation, such as with `pip install --require-hashes -r requirements.txt`. 4. Use an explicitly configured trusted package index or an internally controlled artifact repository. 5. Review dependency updates before changing the pinned version, including transitive dependency changes and package provenance. 6. Perform installation and execution in a least-privileged virtual environment or sandbox that cannot access unrelated credentials and sensitive files. 7. Ensure the documentation's quick-start command uses the same exact version and verification controls as the metadata declaration.