T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:25
- Finding
- Unpinned Third-Party Dependencies Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-39`; `manifest.yaml:33-36` **Vulnerability Type**: Unpinned and integrity-unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code Snippet `SKILL.md:25-39`: ```bash pip install Pillow ``` ```bash pip install rembg ``` `manifest.yaml:33-36`: ```yaml dependencies: pip: - Pillow - rembg ``` ### Technical Analysis The project installs `Pillow` and `rembg` without fixed versions, package hashes, or a lock file. Consequently, installation resolves whichever package release the configured Python package index currently serves. The reviewed source therefore does not fully determine the code that will execute in the user's environment. The `rembg` functionality additionally downloads a machine-learning model during its first execution. Although this behavior is disclosed in the documentation, the project does not pin or verify the model artifact itself. This expands the externally controlled supply-chain surface beyond the Python dependencies. There is no evidence in the audited project that either dependency is currently malicious. The risk arises because future package releases, a compromised package index or maintainer account, an unsafe alternate index, or an unverified model artifact could introduce code or data that was not part of this audit. ### Attack Path 1. An attacker compromises a dependency maintainer account, package distribution channel, configured package index, or model distribution source. 2. The attacker publishes or serves a malicious release or artifact under the expected dependency name. 3. A user follows the documented unpinned `pip install` instructions, or an automated installer resolves the dependencies from `manifest.yaml`. 4. The malicious dependency executes with the privileges of the user running Python, either during installation, import, or skill execution. 5. For background removal, invoking `remove-bg` imports `rembg` and may ...[truncated 740 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to a reviewed exact version, for example: ```text Pillow==<reviewed-version> rembg==<reviewed-version> ``` 2. Generate a lock file containing cryptographic hashes and install with hash verification, such as: ```bash pip install --require-hashes -r requirements.txt ``` 3. Specify and document the trusted package index rather than inheriting an arbitrary environment-level index configuration. 4. Separate the optional `rembg` dependency from the mandatory Pillow dependency so background-removal components are installed only when explicitly needed. 5. Pin the `rembg` model version and expected download location. Verify its cryptographic digest before loading it. 6. Perform dependency vulnerability scanning and periodically review pinned versions before updating them. 7. Prefer installation in an isolated virtual environment with only the filesystem and network permissions required for image processing. ]]>