T08 · Insecure Dependencies
- Location
SKILL.md:45- Finding
Unpinned Python Dependencies and Mutable Runtime Tokenizer Retrieval
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:45-48,SKILL.md:306-310,scripts/token-estimator.py:15-30, andscripts/token-estimator.py:48-53
Vulnerability Type: Supply-chain exposure through unpinned dependencies and mutable external artifacts
Risk Level: MediumVulnerable Code
SKILL.md:45-48:bash # ClAWHub installation clawhub install token-estimator # Install dependencies pip3 install tiktoken transformers dashscopeSKILL.md:306-310:python # requirements.txt tiktoken>=0.5.0 # OpenAI/Gemini tokenizer transformers>=4.30.0 # Qwen tokenizer dashscope>=1.14.0 # Bailian API model informationscripts/token-estimator.py:15-30:python # Attempt to import tokenizer libraries try: import tiktoken TIKTOKEN_AVAILABLE = True except ImportError: TIKTOKEN_AVAILABLE = False try: from transformers import AutoTokenizer TRANSFORMERS_AVAILABLE = True except ImportError: TRANSFORMERS_AVAILABLE = False try: import dashscope DASHSCOPE_AVAILABLE = True except ImportError: DASHSCOPE_AVAILABLE = Falsescripts/token-estimator.py:48-53:python if TRANSFORMERS_AVAILABLE: try: print(f"🔧 Using Qwen Tokenizer (transformers)", file=sys.stderr) return AutoTokenizer.from_pretrained("Qwen/Qwen-7B") except Exception as e: print(f"⚠️ Qwen Tokenizer loading failed: {e}", file=sys.stderr)Technical Analysis
The documented installation command resolves the current available releases of
tiktoken,transformers, anddashscopewithout exact version or artifact-hash verification. The example dependency declarations only specify minimum versions, which also permit future, unaudited releases.These packages are imported when the script starts. Python packages can execute module initialization code during import, so a compromised ups ...[truncated 2336 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin every Python dependency to an exact reviewed version in a requirements or lock file.
-
Require package hashes, for example by generating a hash-locked requirements file and installing with
pip --require-hashes. -
Remove the unused
dashscopedependency and import unless they become necessary for implemented functionality. -
Pin the Hugging Face tokenizer to a reviewed immutable commit:
python AutoTokenizer.from_pretrained( "Qwen/Qwen-7B", revision="REVIEWED_COMMIT_SHA", trust_remote_code=False, ) -
Pre-download and verify tokenizer artifacts during a controlled build process. Use local-only loading in production where practical.
-
Document that the first tokenizer load may access an external service; provide an explicitly offline fallback.
-
Run the Skill in a restricted environment with minimal filesystem permissions, filtered environment variables, resource limits, and constrained outbound network access.
-
Use automated dependency vulnerability scanning and review lockfile updates before release.
-