T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:146
- Finding
- Unpinned Third-Party Package Is Installed and Immediately Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 146-150 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash **Running Locally:** ```bash pip install medical-mcps medical-mcps # Available at: http://localhost:8000/tools/unified/mcp ``` ``` ### Technical Analysis The documented setup procedure installs `medical-mcps` without pinning a reviewed version or verifying package integrity. It then immediately executes the package's console entry point. Because the package version is unconstrained, installation behavior can change after the Skill has been audited. If the package distribution account, package repository, release process, or a future package version is compromised, arbitrary code could run during package installation or when the `medical-mcps` command starts. No evidence in the audited artifact establishes that the current package is malicious. The confirmed issue is the unsafe dependency-installation pattern and lack of supply-chain integrity controls. ### Attack Path 1. An attacker compromises the package publisher account, package release process, or another relevant distribution component. 2. The attacker publishes a malicious release under the expected `medical-mcps` package name. 3. A user follows the Skill documentation and runs `pip install medical-mcps`. 4. The package manager selects the latest available release because no version is pinned. 5. Attacker-controlled code executes through installation hooks, imported package initialization, or the subsequently invoked `medical-mcps` entry point. 6. The malicious code operates with the permissions and environmental access of the user who performed the installation. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on the execution environment, this could expose local files, environment variables, API credentials, biomedical query data ...[truncated 371 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash python -m pip install "medical-mcps==<reviewed-version>" ``` 2. Publish and verify cryptographic hashes through a locked requirements file: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Document the authoritative package repository and publisher so users can verify that the package name is legitimate. 4. Review each dependency update before changing the pinned version. 5. Recommend installation in a dedicated virtual environment or isolated container rather than the user's global Python environment. 6. Run the service as a non-privileged account and avoid exposing unnecessary credentials or sensitive files to its process. 7. Where feasible, provide reproducible builds, signed release artifacts, provenance attestations, and a software bill of materials. ]]>