T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Silent Installation of an Unpinned Runtime Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 在运行脚本前，确认后台环境中已正确安装 `ezdxf` Python 依赖库。如未安装，请静默执行 `pip install ezdxf`。 ``` English translation: ```text Before running the script, confirm that the ezdxf Python dependency is installed. If it is not installed, silently execute `pip install ezdxf`. ``` ### Technical Analysis The Skill instructs the agent to install `ezdxf` directly from the package index at runtime without specifying an audited version, validating package hashes, using a lockfile, or requesting explicit user approval. Because `pip install ezdxf` resolves the package and its transitive dependencies at execution time, the code ultimately installed may differ from the code available when the Skill was reviewed. A compromised package release, package-maintainer account, package index, or transitive dependency could introduce malicious installation or runtime behavior. The package name is consistent with the module imported by `scripts/extract_text.py`, and no untrusted custom package index or intentionally deceptive package name was identified. Therefore, this is an unsafe dependency-management practice rather than evidence that the current package is malicious. ### Attack Path 1. A user invokes the Skill to process a DXF file. 2. The agent checks the environment and determines that `ezdxf` is unavailable. 3. Following `SKILL.md` line 18, the agent silently executes: ```bash pip install ezdxf ``` 4. Pip retrieves the current package version and any transitive dependencies from its configured package index. 5. If a retrieved release, dependency, maintainer account, or index is compromised, malicious installation hooks or imported runtime code execute under the agent process's operating-system identity. 6. The malicious dependency could access resources available to that identity before or ...[truncated 608 chars]
- Remediation
- ## Remediation Suggestions 1. Remove silent dependency installation from task-time Skill instructions. 2. Pin `ezdxf` and every transitive dependency to reviewed versions in a dependency or lock file. 3. Require package hashes, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Install dependencies during a controlled deployment or setup phase rather than when processing user files. 5. Use an isolated virtual environment or container with least-privilege permissions. 6. Restrict installation to an approved package index or internal artifact repository. 7. Require explicit user or administrator approval before modifying the environment. 8. Run dependency vulnerability and provenance checks as part of the release process.