T08 · Insecure Dependencies
Warning
- Location
- INSTALL.md:123
- Finding
- Unpinned and Unverified Third-Party Dependency Installation## Vulnerability Details **File Location**: - `INSTALL.md:123-136` - `INSTALL.md:233-236` - `README.md:80-86` - `README.md:174-177` **Vulnerability Type**: Supply-chain risk caused by an unpinned and unverified Python dependency **Risk Level**: Medium ### Vulnerable Code Snippets `INSTALL.md:123-136`: ```markdown ## Step 6: (Optional) Install Integrations ### Todoist Integration **Why:** See your tasks in morning brief and daily summary. **How:** ```bash # Install Todoist CLI pip install todoist-cli # Login todoist login ``` ``` `INSTALL.md:233-236`: ```markdown If this fails: ```bash pip install todoist-cli todoist login ``` ``` `README.md:80-86`: ```markdown ### Step 3: (Optional) Install Integrations **For Todoist integration:** ```bash pip install todoist-cli todoist login ``` ``` `README.md:174-177`: ```markdown If this fails: ```bash pip install todoist-cli todoist login ``` ``` ### Technical Analysis The documentation instructs users to install `todoist-cli` without specifying an exact version, validating package hashes, linking to a verified publisher, or using a reviewed lock file. The resulting package and its transitive dependencies are resolved dynamically from the user's configured Python package index. Consequently, the code installed when a user follows these instructions can change after the Skill itself has been audited. Risks include a compromised future release, compromised transitive dependency, package-index substitution, or installation from an untrusted index configured in the user's environment. This finding does not establish that the current `todoist-cli` package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation procedure. ### Attack Path 1. An attacker compromises the referenced package, one of its transitive dependencies, or a package index trusted by the victim. 2. The ...[truncated 1172 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `todoist-cli` to an exact, reviewed version rather than resolving the latest release: ```bash python -m pip install "todoist-cli==<reviewed-version>" ``` 2. Publish a dependency lock file containing cryptographic hashes for the package and all transitive dependencies. Require hash verification during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Document the expected package publisher, canonical source repository, and verified package-index page so users can detect similarly named or substituted packages. 4. Recommend installation in a dedicated virtual environment or through `pipx` to limit package conflicts and reduce exposure: ```bash pipx install "todoist-cli==<reviewed-version>" ``` 5. Audit the pinned package and its full dependency tree before publishing the selected version and hashes. 6. Use a controlled package index or explicitly documented trusted index where feasible. Do not recommend bypassing TLS checks or adding unverified package sources. 7. Add a dependency-update process that reviews new releases, regenerates hashes, runs security scanning, and updates the pinned version only after validation.