T08 · Insecure Dependencies
Warning
- Location
- scripts/eval-skill.py:25
- Finding
- Unmanaged Third-Party YAML Dependency Contradicts Self-Contained Execution## Vulnerability Details **File Location**: `scripts/eval-skill.py:25` **Vulnerability Type**: Unmanaged third-party dependency and unsafe ambient module resolution **Risk Level**: Medium ### Vulnerable Code ```python import argparse import ast import json import os import re import sys import yaml ``` ### Technical Analysis The evaluator imports the third-party `yaml` module, provided in typical environments by PyYAML. However, the project does not include a dependency manifest, version constraint, lockfile, package hash, or documented trusted installation source. This conflicts with the documented claim that the evaluator is self-contained and uses no external dependencies. Python resolves imports from its runtime search path. Consequently, the script may load an incompatible, compromised, dependency-confusion-supplied, or locally shadowed `yaml` module. Imported Python modules execute their top-level code immediately, before the evaluator processes the target Skill. Although the audited project does not itself install a malicious dependency, it relies on an unmanaged ambient package and therefore cannot ensure the integrity of the code executed under the `yaml` name. The later use of `yaml.safe_load` reduces risks associated with unsafe YAML object deserialization, but it does not protect against malicious code executing when the `yaml` module is initially imported. ### Attack Path 1. A user prepares an environment to run `scripts/eval-skill.py`. 2. A malicious or compromised package providing the `yaml` module is introduced into that environment, or an attacker places a shadowing `yaml.py` or `yaml` package in a location searched before the legitimate PyYAML installation. 3. The user invokes `python3 scripts/eval-skill.py <skill-path>`. 4. Python resolves `import yaml` to the attacker-controlled module. 5. The module's top-level code executes immediately with the privileges and environment of the us ...[truncated 754 chars]
- Remediation
- ## Remediation Suggestions 1. Explicitly declare PyYAML in a dependency manifest and pin it to a reviewed version. 2. Use a reproducible lockfile with cryptographic hashes, such as a hash-locked `requirements.txt`, and install only from a trusted package index. 3. Run the evaluator in an isolated virtual environment rather than relying on packages from the user's ambient Python environment. 4. Consider replacing PyYAML with a minimal bundled frontmatter parser if the project must remain genuinely self-contained. 5. Correct the documentation if an external dependency remains required, including the exact package name, supported version, and trusted installation procedure. 6. Avoid adding untrusted directories to `PYTHONPATH`, and execute the evaluator from a controlled, non-writable installation directory to reduce module-shadowing exposure. 7. Add automated dependency auditing and integrity verification to the release process.