T08 · Insecure Dependencies
Warning
- Location
- agent.py:8
- Finding
- Automatic Installation of Unpinned Dependencies at Module Import## Vulnerability Details **File Location**: `agent.py:8-16` **Vulnerability Type**: Unpinned runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```python # 自动安装依赖库（若用户未安装） def install_dependencies(): required_packages = ["qrcode", "pillow"] for package in required_packages: try: __import__(package) # 检查库是否已安装 except ImportError: # 自动安装缺失的库 subprocess.check_call([sys.executable, "-m", "pip", "install", package]) # 初始化：安装依赖库 install_dependencies() ``` The behavior is also explicitly documented in `SKILL.md:36-38`: ```markdown - 未安装依赖库：自动尝试安装 qrcode 和 Pillow，若安装失败，提示用户手动执行“pip install qrcode pillow”； ``` ### Technical Analysis Importing `agent.py` invokes `install_dependencies()` automatically. When a listed import is considered unavailable, the function executes `pip install` using an unconstrained package name. It does not pin versions, verify package hashes, require a trusted repository, or request user approval. Consequently, package selection depends on the process environment and its configured pip indexes. A compromised index, malicious dependency release, or attacker-controlled package source could cause untrusted package installation or build logic to execute. There is also an implementation error in the availability check: the distribution named `pillow` is normally imported as `PIL`, not `pillow`. Calling `__import__("pillow")` therefore generally raises `ImportError` even when Pillow is installed, causing a pip command to be launched whenever the module is loaded. Conversely, the top-level imports of `qrcode` and `PIL` occur before this installer runs, so genuinely missing dependencies may prevent the intended recovery mechanism from running at all. ### Attack Path 1. The skill module is loaded by the Agent process. 2. Module initialization invokes `install_dependencies()`. 3. A dependency is missing o ...[truncated 1193 chars]
- Remediation
- ## Remediation Suggestions 1. Remove dependency installation from module import and never modify the runtime environment merely by loading the skill. 2. Declare dependencies in a controlled deployment manifest or lockfile and install them before the Agent starts. 3. Pin exact reviewed versions of `qrcode` and `Pillow`. 4. Require package hashes, such as through a hash-locked requirements file and `pip install --require-hashes`. 5. Use an explicitly configured, trusted package repository rather than inheriting arbitrary pip index settings. 6. Perform dependency installation in an isolated virtual environment under a low-privilege deployment account. 7. If runtime installation is unavoidable, require explicit administrator or user approval and log the package name, version, source, and verified hash. 8. Correct dependency checks to inspect the actual import names, particularly `PIL` for Pillow. 9. Move any dependency diagnostics before application imports only as a non-installing check that produces a clear setup error.