T08 · Insecure Dependencies
Warning
- Location
scripts/main.py:32- Finding
Automatic Installation of Unpinned Runtime Dependencies
- Content
View full analysis
None: pip_name = pip_name or import_name try: importlib.import_module(import_name) return except ImportError: print(f"缺少 {pip_name}，正在自动安装...", file=sys.stderr) result = subprocess.run( [sys.executable, "-m", "pip", "install", pip_name], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, ) if result.returncode != 0: raise RuntimeError( f"自动安装 {pip_name} 失败，请手动执行: {sys.executable} -m pip install {pip_name}\n" f"{result.stderr.strip()}" ) importlib.import_module(import_name) ensure_python_package("requests") ensure_python_package("openpyxl") ``` ### Technical Analysis The script automatically invokes `pip install` when either `requests` or `openpyxl` is unavailable. Installation occurs during normal script startup, without user confirmation, package version pinning, hash verification, or isolation from the invoking Python environment. Although the package names are legitimate and no dependency confusion or typosquatting is directly present in the repository, the installation source is determined by the runtime pip configuration. A compromised package index, malicious mirror, dependency-chain compromise, or future compromised package release could introduce executable code after the Skill has already passed review. Python package installation can execute package build logic, and importing the newly installed package immediately afterward executes its initialization code. This makes the effective runtime code dependent on mutable external package sources. ### Attack Path 1. The script runs in an environment where `r ...[truncated 1122 chars]- Remediation
View remediation