T08 · Insecure Dependencies
- Location
scripts/大群空间版本查询.sh:30- Finding
Unpinned Automatic Dependency and Browser Installation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/大群空间版本查询.sh, lines 30–47
Vulnerability Type: Unpinned third-party dependency and browser installation
Risk Level: MediumVulnerable Code
bash # requests if ! $PYTHON -c "import requests" 2>/dev/null; then echo "[*] 安装 requests ..." $PYTHON -m pip install requests --quiet fi echo "[OK] requests" # playwright if ! $PYTHON -c "from playwright.sync_api import sync_playwright" 2>/dev/null; then echo "[*] 安装 playwright ..." $PYTHON -m pip install playwright --quiet echo "[*] 安装 Chromium (playwright) ..." $PYTHON -m playwright install chromium --with-deps 2>/dev/null || \ $PYTHON -m playwright install chromium 2>/dev/null fi echo "[OK] playwright + Chromium"Technical Analysis
The documented entry script automatically installs the latest available versions of
requestsandplaywrightfrom the Python package index configured in the execution environment. It does not constrain package versions, verify artifact hashes, enforce a trusted repository, or use a locked dependency manifest.It subsequently invokes Playwright to download a Chromium build. The
--with-depsoption may also invoke operating-system package-management operations to install browser dependencies. These mutable external components and installation procedures become executable parts of the Skill without having been included in the reviewed project.An attacker who compromises a configured package index, a legitimate dependency release, its transitive dependency chain, or the browser distribution channel could cause malicious installation or runtime code to execute. A locally configured malicious index or package mirror could provide the same result. This is a supply-chain risk; the audited files do not themselves establish that any currently distributed dependency is malicious.
Attack Path
- The user or agent follows the document ...[truncated 1413 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic dependency installation from the normal runtime path. If a dependency is missing, stop and provide explicit setup instructions.
- Define exact dependency versions in a lock file and verify downloaded artifacts using cryptographic hashes, such as with pip's
--require-hashes. - Install dependencies into a dedicated virtual environment rather than the invoking user's global Python environment.
- Configure an explicitly trusted package index and prevent unintended index or mirror overrides in controlled deployments.
- Pin the Playwright package and its compatible Chromium revision. Pre-provision and validate the browser artifact where practical.
- Move
playwright install --with-depsinto a separate, explicit setup step requiring informed user approval. Do not perform operating-system package installation during an ordinary version query. - Run the query process as a non-privileged user in a sandbox or container with restricted filesystem and network access.
- Add dependency update and integrity-review procedures so version changes are reviewed before deployment.