T08 · Insecure Dependencies
Warning
- Location
scripts/setup.py:21- Finding
Unpinned Dependencies and Mutable Model Downloads from a Non-Official Mirror
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup.py:21-37;scripts/memory_store.py:4-8, 35;scripts/memory_recall.py:4-8, 30;scripts/memory_forget.py:4-8, 50
Vulnerability Type: Supply-chain exposure through unpinned dependencies and unverified model artifacts
Risk Level: MediumVulnerable Code
scripts/setup.py:21-37:python # 1. torch CPU run( [py, "-m", "pip", "install", "torch", "--index-url", "https://download.pytorch.org/whl/cpu"], "安装 torch (CPU)", ) # 2. chromadb + sentence-transformers + certifi run( [py, "-m", "pip", "install", "chromadb", "sentence-transformers", "certifi"], "安装 chromadb、sentence-transformers 和 certifi", ) # 3. 预下载模型 print(json.dumps({"step": "预下载 BGE-small-zh-v1.5 模型", "status": "running"}, ensure_ascii=False)) try: from sentence_transformers import SentenceTransformer SentenceTransformer("BAAI/bge-small-zh-v1.5")scripts/memory_store.py:4-8, 35:python import os import certifi os.environ.setdefault("HF_ENDPOINT", "https://hf-mirror.com") os.environ.setdefault("REQUESTS_CA_BUNDLE", certifi.where()) os.environ.setdefault("SSL_CERT_FILE", certifi.where()) model = SentenceTransformer(MODEL_NAME)scripts/memory_recall.py:4-8, 30:python import os import certifi os.environ.setdefault("HF_ENDPOINT", "https://hf-mirror.com") os.environ.setdefault("REQUESTS_CA_BUNDLE", certifi.where()) os.environ.setdefault("SSL_CERT_FILE", certifi.where()) model = SentenceTransformer(MODEL_NAME)scripts/memory_forget.py:4-8, 50:python import os import certifi os.environ.setdefault("HF_ENDPOINT", "https://hf-mirror.com") os.environ.setdefault("REQUESTS_CA_BUNDLE", certifi.where()) os.environ.setdefault("SSL_CERT_FILE", certifi.where()) model = SentenceTransformer(MODEL_NAME)Technical Analysis
The setup script installs
torch,chromadb, `sentence- ...[truncated 2663 chars]- Remediation
View remediation
Remediation Suggestions
- Pin every Python dependency to an exact reviewed version, including transitive dependencies through a generated lockfile.
- Require package hashes, for example by using a hash-locked requirements file with
pip install --require-hashes. - Retain trusted package indexes explicitly and prevent unintended fallback to additional indexes.
- Pin the Hugging Face model to an immutable commit revision rather than loading only by repository name.
- Verify model files against approved cryptographic hashes before loading them.
- Prefer the official Hugging Face endpoint. If a mirror is operationally required, document its trust model, restrict it to an approved mirror, and independently verify downloaded artifacts.
- Download and validate dependencies and model artifacts during a controlled build process, then deploy from an internal immutable artifact repository.
- Install the dependencies in an isolated virtual environment or container under a non-privileged account.
- Add automated dependency and artifact provenance checks to CI, and periodically review pinned versions for known vulnerabilities.
- Update the documentation to clarify that the Skill operates offline only after verified dependencies and model artifacts have been installed and cached.