pip

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:28 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward pip helper for Python dependency management, with normal package-installation risks disclosed by its purpose.

Install this only if you want Codex to help run pip workflows. Prefer --venv, review requirements files before installing, pin versions or use hashes for sensitive projects, and be careful with uninstall because the helper confirms removal automatically with -y.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/pip-safe.sh:91

Finding

Unpinned and Unvalidated Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/pip-safe.sh:91, scripts/pip-safe.sh:123-126, scripts/pip-safe.sh:148-151; SKILL.md:53, SKILL.md:63, SKILL.md:87, SKILL.md:103-104
Vulnerability Type: Supply-chain exposure through unpinned packages, unvalidated requirement files, and automatic build-tool upgrades
Risk Level: Medium

Vulnerable Code

The virtual-environment workflow automatically upgrades foundational packaging tools from the active pip index:

bash

ensure-venv)
  venv_dir="${1:-}"
  [[ -n "$venv_dir" ]] || usage
  if [[ ! -d "$venv_dir" ]]; then
    "$python_bin" -m venv "$venv_dir"
  fi
  "$venv_dir/bin/python" -m pip install --upgrade pip setuptools wheel
  ;;

Arbitrary package arguments are passed directly to pip, including when no virtual environment is selected:

bash

if [[ -n "$venv_dir" ]]; then
  pip_with_venv "$python_bin" "$venv_dir" install "${extra[@]}" "$@"
else
  pip_with_python "$python_bin" install "${extra[@]}" "$@"
fi

Requirement files are installed without validating package sources, hashes, or version constraints:

bash

req_file="${1:-}"
[[ -n "$req_file" ]] || die "missing requirements file"
[[ -f "$req_file" ]] || die "requirements file not found: $req_file"

if [[ -n "$venv_dir" ]]; then
  pip_with_venv "$python_bin" "$venv_dir" install -r "$req_file"
else
  pip_with_python "$python_bin" install -r "$req_file"
fi

The accompanying instructions also recommend unpinned installations and build-tool upgrades:

bash

python3 -m pip install requests pydantic
python3 -m pip install -U pip setuptools wheel

Technical Analysis

Package names, versions, download indexes, direct URLs, and requirement-file contents are not validated before being supplied to pip. The workflow does not require exact version pins, cryptographic hashes, or a trusted package index.

Installing a Python package can ...[truncated 2030 chars]

Remediation

View remediation

Remediation Suggestions

1. Require --venv for installation, removal, requirements, and freeze operations. If non-virtual-environment operation is necessary, require an explicit option such as --allow-non-venv and interactive confirmation.
2. Do not automatically upgrade pip, setuptools, and wheel during virtual-environment creation. Separate this into an explicit, user-approved operation with pinned versions.
3. Prefer exact dependency pins and hash verification, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Generate and review lock files through a controlled dependency-resolution process. Commit approved hashes and versions to the project.
5. Restrict installation to explicitly trusted indexes and disable implicit fallback indexes where practical:

   bash

   python -m pip install \
     --index-url https://pypi.org/simple \
     --require-hashes \
     -r requirements.txt
   

6. Validate and reject unexpected direct URLs, editable installs, local paths, archive references, additional index directives, and other unsafe requirement-file options unless the user explicitly approves them.
7. Display the resolved interpreter, pip configuration, index hosts, packages, versions, and requirement source before installation.
8. Require explicit approval before installing unknown packages or dependencies that require local builds.
9. Perform higher-risk package builds in an isolated container or similarly restricted environment with limited credentials, filesystem access, and network connectivity.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill clearly enables package installation workflows using pip, which inherently perform network access to fetch packages and metadata from package indexes. Because the skill does not declare an explicit tool scope such as permissions or allowed-tools, consumers and enforcement layers may not have clear visibility or policy control over that network-capable behavior, increasing the risk of unintended package retrieval or policy bypass.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The uninstall command invokes pip uninstall -y, which forcefully removes packages without an interactive prompt. Although the script has usage text, it does not explicitly warn that uninstallation is automatic and non-interactive, making this destructive action easy to trigger without user disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.