T08 · Insecure Dependencies
Error
- Location
- scripts/export-sandbox-pptx.py:60
- Finding
- Automatic Installation of Unpinned Runtime Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/export-sandbox-pptx.py:60-72` **Vulnerability Type**: Automatic installation of mutable third-party packages **Risk Level**: High ### Vulnerable Code ```python def _attempt_install_missing_deps(missing: List[str]) -> bool: if not missing: return True if os.environ.get("KAI_EXPORT_PPT_LITE_AUTO_INSTALL", "1").lower() in {"0", "false", "no"}: return False try: subprocess.run( [sys.executable, "-m", "pip", "install", *missing], check=True, stdout=sys.stderr, stderr=sys.stderr, ) return True except Exception: return False ``` The corresponding dependency declarations in `requirements.txt:1-4` only specify minimum versions: ```text beautifulsoup4>=4.12.0 lxml>=4.9.0 python-pptx>=0.6.23 Pillow>=10.0.0 ``` ### Technical Analysis Importing the exporter invokes dependency detection and automatically runs `pip install` when packages are missing. Automatic installation is enabled by default. Package versions are not pinned exactly, package hashes are not verified, and the command does not enforce an approved package index. Consequently, the installed code can vary after the Skill has been audited. The effective source is also affected by the runtime's pip configuration and package index settings. Although the package names appear legitimate and no intentionally malicious package was identified, this creates a supply-chain execution boundary that is not deterministic or adequately controlled. The subprocess call does not use a shell, so it is not directly vulnerable to shell metacharacter injection. The risk instead comes from executing installation logic and imported code from mutable third-party artifacts. ### Attack Path 1. The exporter runs in an environment where one or more dependencies are absent. 2. `_attempt_install_missing_deps()` is called automatically. 3. Pip resolves the package ...[truncated 873 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable automatic dependency installation by default. Require an explicit operator-controlled opt-in if runtime installation is unavoidable. 2. Install dependencies during a controlled build or deployment phase rather than while processing presentation input. 3. Pin exact dependency versions instead of using minimum-version constraints. 4. Generate and enforce hashes using a locked requirements file, for example with `--require-hashes`. 5. Require a trusted, explicitly configured package index and disable unintended extra indexes. 6. Use a dedicated virtual environment with minimum filesystem and network privileges. 7. Fail closed with a clear dependency error when required packages are unavailable. 8. Add dependency scanning, lockfile review, and reproducible-build checks to release validation. ]]>