T08 · Insecure Dependencies
Error
- Location
scripts/export-sandbox-pptx.py:60- Finding
Automatic Installation of Unpinned Runtime Dependencies
- Content
View full analysis
bool: if not missing: return True if os.environ.get("KAI_EXPORT_PPT_LITE_AUTO_INSTALL", "1").lower() in {"0", "false", "no"}: return False try: subprocess.run( [sys.executable, "-m", "pip", "install", *missing], check=True, stdout=sys.stderr, stderr=sys.stderr, ) return True except Exception: return False ``` The corresponding dependency declarations in `requirements.txt:1-4` only specify minimum versions: ```text beautifulsoup4>=4.12.0 lxml>=4.9.0 python-pptx>=0.6.23 Pillow>=10.0.0 ``` ### Technical Analysis Importing the exporter invokes dependency detection and automatically runs `pip install` when packages are missing. Automatic installation is enabled by default. Package versions are not pinned exactly, package hashes are not verified, and the command does not enforce an approved package index. Consequently, the installed code can vary after the Skill has been audited. The effective source is also affected by the runtime's pip configuration and package index settings. Although the package names appear legitimate and no intentionally malicious package was identified, this creates a supply-chain execution boundary that is not deterministic or adequately controlled. The subprocess call does not use a shell, so it is not directly vulnerable to shell metacharacter injection. The risk instead comes from executing installation logic and imported code from mutable third-party artifacts. ### Attack Path 1. The exporter runs in an environment where one or more dependencies are absent. 2. `_attempt_install_missing_deps()` is called automatically. 3. Pip resolves the package ...[truncated 873 chars]- Remediation
View remediation
```
2. The exporter reads the supplied source without enforcing an asset-root boundary.
3. The target file is opened with the permissions of the Agent process.
4. If the file contains a supported image, it is inserted into the generated PPTX.
5. The attacker obtains the PPTX and extracts or views the embedded image.
6. Alternatively, a very large file or malicious image can b
...[truncated 515 chars]