T08 · Insecure Dependencies
- Location
SKILL.md:48- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 48–50
Vulnerability Type: Unpinned third-party dependencies from a mutable package repository
Risk Level: MediumVulnerable Code
bash pip3 install ebooklib beautifulsoup4 lxmlTechnical Analysis
The EPUB import workflow instructs the agent to install three Python packages without fixed versions, cryptographic hashes, a lock file, or an explicitly trusted package index. Consequently, every installation may resolve different package or transitive-dependency versions from the default Python package repository.
This does not establish that any current package is malicious. It creates a supply-chain exposure in which a compromised package release, compromised maintainer account, or malicious transitive dependency could introduce arbitrary installation-time or import-time code after the Skill has already been reviewed.
Attack Path
- An attacker compromises one of the named packages, one of its transitive dependencies, or its package-publishing account.
- The attacker publishes a malicious version that remains compatible with the unconstrained package specification.
- A user invokes the EPUB import feature on a system where the dependencies are not already installed.
- Following the documented workflow, the agent executes the unpinned
pip3 installcommand. - The package installer selects the malicious release.
- Malicious installation-time code, or code subsequently loaded by
process_epub.py, executes with the privileges of the user running the agent.
Impact Assessment
Successful exploitation could execute arbitrary code with the agent user's privileges. Depending on that user's access, the malicious dependency could read or modify workspace files, EPUB contents, reading-progress data, and other user-accessible files; alter installed Python components; or initiate network communications. No privilege escalation beyond the invoking user's existing permissions ...[truncated 41 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every direct dependency to a reviewed, exact version.
- Resolve and pin all transitive dependencies in a lock file.
- Record cryptographic hashes and require hash verification during installation, for example with
pip install --require-hashes -r requirements.txt. - Install dependencies inside a dedicated virtual environment rather than the agent user's global Python environment.
- Use an explicitly configured trusted package index or an internally controlled package mirror.
- Add automated dependency vulnerability and integrity scanning to the release process.
- Review and deliberately update dependency versions instead of resolving the newest available releases during Skill invocation.