T08 · Insecure Dependencies
- Location
INSTALL.md:123- Finding
Unpinned and Unverified Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
INSTALL.md:123-136INSTALL.md:233-236README.md:80-86README.md:174-177
Vulnerability Type: Supply-chain risk caused by an unpinned and unverified Python dependency
Risk Level: MediumVulnerable Code Snippets
INSTALL.md:123-136:markdown ## Step 6: (Optional) Install Integrations ### Todoist Integration **Why:** See your tasks in morning brief and daily summary. **How:** ```bash # Install Todoist CLI pip install todoist-cli # Login todoist logintext `INSTALL.md:233-236`: ```markdown If this fails: ```bash pip install todoist-cli todoist logintext `README.md:80-86`: ```markdown ### Step 3: (Optional) Install Integrations **For Todoist integration:** ```bash pip install todoist-cli todoist logintext `README.md:174-177`: ```markdown If this fails: ```bash pip install todoist-cli todoist logintext ### Technical Analysis The documentation instructs users to install `todoist-cli` without specifying an exact version, validating package hashes, linking to a verified publisher, or using a reviewed lock file. The resulting package and its transitive dependencies are resolved dynamically from the user's configured Python package index. Consequently, the code installed when a user follows these instructions can change after the Skill itself has been audited. Risks include a compromised future release, compromised transitive dependency, package-index substitution, or installation from an untrusted index configured in the user's environment. This finding does not establish that the current `todoist-cli` package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation procedure. ### Attack Path 1. An attacker compromises the referenced package, one of its transitive dependencies, or a package index trusted by the victim. 2. The ...[truncated 1172 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin
todoist-clito an exact, reviewed version rather than resolving the latest release:bash python -m pip install "todoist-cli==<reviewed-version>" -
Publish a dependency lock file containing cryptographic hashes for the package and all transitive dependencies. Require hash verification during installation:
bash python -m pip install --require-hashes -r requirements.txt -
Document the expected package publisher, canonical source repository, and verified package-index page so users can detect similarly named or substituted packages.
-
Recommend installation in a dedicated virtual environment or through
pipxto limit package conflicts and reduce exposure:bash pipx install "todoist-cli==<reviewed-version>" -
Audit the pinned package and its full dependency tree before publishing the selected version and hashes.
-
Use a controlled package index or explicitly documented trusted index where feasible. Do not recommend bypassing TLS checks or adding unverified package sources.
-
Add a dependency-update process that reviews new releases, regenerates hashes, runs security scanning, and updates the pinned version only after validation.
-