T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:69
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 69–70 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code**: ```text - If `openpyxl` not installed: `pip install openpyxl` - If `xlsxwriter` not installed: `pip install xlsxwriter` ``` ### Technical Analysis The Skill instructs the agent to install third-party Python packages without exact version constraints, integrity hashes, an explicitly approved package index, or user confirmation. Consequently, package contents and transitive dependencies can vary between executions. Python package installation can execute package build and installation logic. If a package source, release, dependency, or configured package index is compromised or substituted, attacker-controlled code could execute during installation. The absence of a lock file and hash verification prevents the installer from confirming that the resolved artifacts are the versions reviewed and approved by the project. ### Attack Path 1. A user invokes the Excel Builder Skill in an environment where `openpyxl` or `xlsxwriter` is unavailable. 2. The agent follows the documented error-handling instruction and executes the corresponding unpinned `pip install` command. 3. `pip` resolves the current package release and its transitive dependencies through the environment's configured package index. 4. A compromised index, package release, or transitive dependency supplies malicious installation or runtime code. 5. The malicious code executes with the privileges of the account running `pip` and may subsequently run again when the installed library is imported. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the privileges of the agent or user performing the installation. The affected scope may include files, environment variables, credentials, network resources, and services accessible to that account. If installation is perfo ...[truncated 184 chars]
- Remediation
- ## Remediation Suggestions - Remove automatic or implicit dependency installation instructions from the Skill workflow. - Require explicit user approval before installing any package. - Define reviewed dependencies in a lock file or requirements file using exact versions. - Record and enforce cryptographic hashes for all direct and transitive dependency artifacts. - Install with a command such as `python -m pip install --require-hashes -r requirements.txt`. - Configure an approved package index and disable unintended fallback indexes. - Perform installation inside a dedicated, least-privileged virtual environment or isolated container. - Periodically scan and update locked dependencies through a controlled review process.