T08 · Insecure Dependencies
Warning
- Location
scripts/main_analysis.py:39- Finding
Unpinned Automatic Runtime Installation of TA-Lib
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main_analysis.py:39-58
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
python def install_ta_lib(): try: # Attempt to import TA-Lib using the explicitly defined PYTHON_EXECUTABLE result = subprocess.run( [PYTHON_EXECUTABLE, "-c", "import talib"], capture_output=True, text=True, check=False ) if result.returncode == 0: print("TA-Lib is already installed.", file=sys.stderr) return True else: print("TA-Lib not found. Attempting to install TA-Lib...", file=sys.stderr) # Use pip to install TA-Lib. Use the explicit Python executable. subprocess.run( [PYTHON_EXECUTABLE, "-m", "pip", "install", "TA-Lib"], check=True, capture_output=True ) print("TA-Lib installed successfully.", file=sys.stderr) return True except subprocess.CalledProcessError as e: print(f"Error installing TA-Lib: {e.stderr}", file=sys.stderr) print("Please install TA-Lib manually using: pip install TA-Lib", file=sys.stderr) return False except Exception as e: print(f"An unexpected error occurred during TA-Lib installation: {e}", file=sys.stderr) return FalseTechnical Analysis
The Skill automatically invokes
pip install TA-Libduring ordinary analysis when thetalibimport check fails. The package is installed without a fixed version, hash verification, lockfile, approved package-index enforcement, or explicit user confirmation.This creates a software supply-chain risk because the package selected at execution time depends on the active pip configuration and the state of its configured indexes. Installation can also run package build or installation logic ...[truncated 2069 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove automatic package installation from the runtime analysis path.
- Declare TA-Lib as a deployment-time dependency with an exact, reviewed version.
- Use a lockfile or requirements file containing cryptographic hashes, and install with hash enforcement such as
pip install --require-hashes. - Install dependencies in an isolated virtual environment during a controlled setup phase rather than modifying the Agent's active interpreter.
- Restrict installation to an approved, authenticated package index and prevent fallback to untrusted extra indexes.
- Verify wheels or source distributions before approval and maintain dependency vulnerability monitoring.
- If automated setup is unavoidable, require explicit user consent, display the exact package version and source, and run installation in a sandbox with minimal filesystem and network permissions.
- Replace the hardcoded interpreter path with a validated configuration or
sys.executableso the dependency check and execution consistently target the intended isolated environment.