T08 · Insecure Dependencies
Error
- Location
scripts/detect.py:27- Finding
Unverified Remote Model Retrieval and Loading
- Content
View full analysis
bool: """Download model weights from GitHub and retry automatically.""" import urllib.request import time os.makedirs(save_dir, exist_ok=True) for filename, url in MODEL_DOWNLOAD_URLS: target = os.path.join(save_dir, filename) if os.path.exists(target): return True for attempt in range(1, max_retries + 1): try: urllib.request.urlretrieve(url, target) return True except Exception as e: if os.path.exists(target): os.remove(target) if attempt < max_retries: time.sleep(attempt * 5) return False ``` The downloaded file is subsequently passed directly to Ultralytics: ```python models_dir = os.path.join(SKILL_DIR, "models") if _download_model(models_dir): for path in MODEL_PATHS: if os.path.exists(path): return YOLO(path), False ``` ### Technical Analysis When no local model is available, the Skill downloads model artifacts from URLs referencing the mutable `main` branch of a third-party GitHub repository. The downloaded files are accepted solely based on successful transfer and existence on disk. The implementation does not perform any of the following controls: - Verification against a pinned SHA-256 digest - Signature or trusted-manifest verification - Pinning to an immutable release or commit - Validation of the downloaded artifact format - Enf ...[truncated 2090 chars]- Remediation
View remediation
", "head-yolov8s.pt": "", } def verify_sha256(path, expected): digest = hashlib.sha256() with open(path, "rb") as model_file: for block in iter(lambda: model_file.read(1024 * 1024), b""): digest.update(block) return digest.hexdigest() == expected ``` 3. Download to a uniquely created temporary file in the destination directory. 4. Enforce an expected maximum and minimum artifact size during transfer. 5. Reject redirects whose final scheme or hostname is not explicitly approved. 6. Validate the hash and artifact structure before atomically renaming the temporary file to the trusted model path. 7. Delete the temporary artifact on every validation or loading failure. 8. Prefer a non-executable tensor serialization format, such as `safetensors`, where the model stack supports it. 9. Consider packaging the reviewed model with the Skill or requiring explicit administrator installation instead of automatic retrieval. ]]>