T08 · Insecure Dependencies
Warning
- Location
SKILL.md:9- Finding
Unpinned Runtime Dependencies Allow Supply-Chain Compromise
- Content
View full analysis
=3.10" # dependencies = [ # "fal-client>=0.5.0", # ] # /// ``` ### Technical Analysis The installation command retrieves the latest available `uv` package without an exact version or integrity hash. The PEP 723 dependency specification similarly permits any `fal-client` version greater than or equal to `0.5.0`. This makes runtime behavior dependent on package versions available from the configured Python package index at execution time. A compromised publisher account, package registry, dependency resolution source, or malicious future release could introduce code that was not present during this audit. Python packages can execute code during installation, import, or normal initialization. In this Skill, `fal_client` is imported after validating that `FAL_KEY` exists, meaning a malicious resolved package would execute in a process that has access to the fal.ai credential and the invoking user's filesystem permissions. ### Attack Path 1. An attacker compromises the `uv` or `fal-client` distribution channel, publisher account, or an applicable package index. 2. The attacker publishes a malicious version satisfying the unconstrained installation request or the `fal-client>=0.5.0` range. 3. The Skill installs or resolves that version through `pip` or `uv run`. 4. Malicious package code executes during installation or import. 5. The package reads `FAL_KEY`, accesses files avail ...[truncated 681 chars]- Remediation
View remediation
", # ] ``` 2. Pin `uv` to an exact reviewed version rather than installing the latest release: ```bash python -m pip install "uv==" ``` 3. Generate and commit a lockfile containing complete transitive dependency versions. 4. Enforce package integrity hashes using a hash-locked requirements workflow or an equivalent verified artifact mechanism. 5. Install only from an explicitly configured trusted package index. 6. Perform dependency upgrades through a controlled process that includes source review, vulnerability scanning, and regression testing. 7. Run the Skill in a restricted environment with access only to required files and credentials. 8. Use a narrowly scoped, revocable fal.ai key and monitor it for unexpected usage. ]]>