T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Python Packages Installed Through pip## Vulnerability Details **File Location**: `SKILL.md:8-12` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: python-pptx kind: shell label: "Install Python dependencies for PPT conversion (optional — only needed for Mode B)" command: "pip install python-pptx Pillow" optional: true ``` Additional installation instructions appear at `SKILL.md:199` and `SKILL.md:319`: ```text Install if needed: `pip install Pillow` ``` ```text Install: `pip install python-pptx` ``` ### Technical Analysis The skill directs the agent to install `python-pptx` and `Pillow` from the configured Python package index without pinning versions or verifying package hashes. It provides no lock file, trusted-index restriction, isolated environment requirement, or integrity validation. A `pip install` operation may execute package build and installation logic with the permissions of the agent process. Because package versions and transitive dependencies are resolved at installation time, the effective code can change after the skill has been reviewed. A compromised package release, dependency, or package-index configuration could therefore introduce arbitrary code into the environment. The installation is marked optional and is relevant only to PowerPoint conversion or image processing, which limits exposure but does not remove the supply-chain risk. ### Attack Path 1. A user requests PowerPoint conversion or image processing. 2. The agent determines that the required Python packages are unavailable. 3. Following the skill instructions, the agent runs `pip install python-pptx Pillow`. 4. `pip` resolves the current package versions and their transitive dependencies from its configured index. 5. A compromised package, malicious dependency, or hostile index response supplies attacker-controlled installation code. 6. That code ...[truncated 693 chars]
- Remediation
- ## Remediation Suggestions 1. Pin all direct and transitive dependencies to reviewed versions. 2. Maintain a hash-locked requirements file and install with `pip install --require-hashes -r requirements.txt`. 3. Use an isolated virtual environment or restricted container for conversion operations. 4. Restrict package downloads to an explicitly trusted package index or internal mirror. 5. Require explicit user approval before performing any package installation. 6. Run dependency installation and document conversion under a low-privilege account with limited filesystem and network access. 7. Regularly scan pinned dependencies for known vulnerabilities and review version upgrades before deployment.