T08 · Insecure Dependencies
Error
- Location
- SKILL.md:35
- Finding
- Unpinned Third-Party Dependencies Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:35-48`; related instructions at `best-practices.md:310`, `trading-reference.md:147-149`, and `trading-reference.md:183-185` **Vulnerability Type**: Unpinned dependencies and unsafe system-wide package installation **Risk Level**: High ### Vulnerable Code ```bash uv python install 3.12 # Ensure Python is available (skip if already installed) uv pip install --system "finlab>=1.5.9" 2>/dev/null || uv pip install "finlab>=1.5.9" ``` ```bash uv run --with "finlab" python3 script.py ``` Additional unpinned installation instructions include: ```bash pip install finlab --upgrade ``` ```bash pip install esun-trade ``` ```bash pip install shioaji ``` ### Technical Analysis The Skill instructs the Agent to download and execute third-party packages without pinning exact versions or verifying package hashes. The constraint `finlab>=1.5.9` permits any future matching release, while `--upgrade` and package names without versions explicitly select package contents that may change after this Skill has been audited. The `--system` option is particularly unsafe because it modifies the system Python environment instead of an isolated project environment. Installation and subsequent import can execute package-controlled build hooks, initialization code, native extensions, and runtime logic. The source code of these dependencies is not included in the audited project, so its behavior cannot be verified from this repository. This creates a software supply-chain exposure. A compromised publisher account, malicious future release, dependency confusion condition, or compromised transitive dependency could introduce arbitrary code into the execution environment. ### Attack Path 1. An attacker compromises a referenced package, its publisher account, or one of its transitive dependencies. 2. The attacker publishes a malicious release satisfying the unbounded version requirement. 3. The Agent follows the Skill and ...[truncated 1313 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed exact version, including FinLab and each broker SDK. 2. Generate and commit a lockfile containing resolved transitive versions. 3. Require cryptographic hashes for downloaded distributions where the package tooling supports them. 4. Remove `--system` and install packages only in a dedicated, least-privileged virtual environment. 5. Replace `uv run --with "finlab"` with execution against the locked environment. 6. Do not use `pip install --upgrade` in runtime Skill instructions. 7. Verify package provenance, registry configuration, publisher identity, and release signatures before updates. 8. Review dependency changes before updating the lockfile and use vulnerability and malware scanning for packages and transitive dependencies. 9. Keep broker integrations in a separate environment with access only to the credentials required for the selected broker. 10. Prevent installation scripts from receiving broker credentials by injecting credentials only after dependency installation and verification are complete. ]]>