T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:75
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:75` **Vulnerability Type**: Unpinned package installation and insufficient supply-chain verification **Risk Level**: Medium **Complete Code Snippet**: ```text - 依赖 openpyxl，首次使用需 `pip install openpyxl` ``` The documentation instructs users to install `openpyxl` directly from the configured Python package index without specifying a reviewed version, a lock file, an approved repository, or cryptographic hashes. ### Technical Analysis Running `pip install openpyxl` resolves a mutable package version and its dependencies according to the user's current pip configuration. The resulting artifacts may therefore change after this Skill has been reviewed. Python package installation can process package metadata and build source distributions, potentially executing build-backend code under the privileges of the user performing the installation. This is a supply-chain hardening weakness rather than evidence that `openpyxl` itself is malicious. Exploitation requires compromise or manipulation of a relevant package release, dependency, configured package index, package-resolution path, or similarly trusted distribution channel. ### Attack Path 1. A user follows the installation instruction in `SKILL.md`. 2. The user runs `pip install openpyxl` without a pinned version or required artifact hashes. 3. pip resolves packages through the user's configured indexes and selects mutable artifacts. 4. An attacker who has compromised an applicable package release, dependency, index, or resolution configuration supplies a malicious artifact. 5. Package build or installation logic executes with the installing user's privileges, or malicious code executes when the installed module is imported. 6. The attacker gains code execution in the affected Python environment. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user who installs or i ...[truncated 524 chars]
- Remediation
- ## Remediation Suggestions 1. Declare dependencies in a dedicated requirements or project configuration file rather than an ad hoc installation command. 2. Pin `openpyxl` and all transitive dependencies to versions that have been reviewed and tested. 3. Generate a lock file containing cryptographic hashes for every permitted distribution artifact. 4. Install dependencies using hash enforcement, such as: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 5. Prefer binary wheels from a trusted, explicitly configured package repository and avoid source builds where feasible. 6. Use an isolated virtual environment and do not install packages with elevated privileges. 7. Add automated dependency vulnerability and provenance scanning to the release process. 8. Periodically update pinned versions through a controlled review and testing workflow.