T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned Third-Party Package Installation Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-27 and 403-407 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:24-27 uv pip install duckduckgo-search # Or install with pip pip install duckduckgo-search ``` ```bash # SKILL.md:403-407 # Ensure pip is the latest version pip install --upgrade pip pip install duckduckgo-search # Or use uv uv pip install duckduckgo-search ``` ### Technical Analysis The Skill instructs the Agent to install `duckduckgo-search` without specifying an exact version or verifying package integrity with cryptographic hashes. Consequently, the package resolver selects whichever compatible release is current when installation occurs, rather than the release reviewed when the Skill was published. Python package installation and subsequent import can execute third-party code with the privileges of the Agent process. If a future package release or its publishing account is compromised, the effective behavior of this Skill can change without any modification to the audited project. The instruction to upgrade `pip` is also unnecessary for the Skill's core search behavior and introduces an additional mutable dependency change. The project does not contain an embedded malicious script, and the reviewed instructions do not demonstrate malicious intent. The issue is the avoidable supply-chain exposure created by installing mutable, unverified dependencies at runtime. ### Attack Path 1. An attacker compromises the upstream package, its publisher account, or the relevant package distribution path. 2. The attacker publishes a malicious release under the expected package name. 3. A user or Agent follows the Skill instructions and runs `pip install duckduckgo-search` or `uv pip install duckduckgo-search`. 4. Because no exact version or integrity hash is required, the resolver downloads the attacker-controlled release. 5. Malicious code e ...[truncated 774 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `duckduckgo-search` to a specific version that has been reviewed and tested: ```bash python -m pip install "duckduckgo-search==<audited-version>" ``` 2. Generate and enforce cryptographic hashes through a locked requirements file: ```text duckduckgo-search==<audited-version> \ --hash=sha256:<verified-package-hash> ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Include and pin all transitive dependencies using a reproducible lockfile generated from a trusted environment. 4. Install dependencies in an isolated virtual environment or disposable sandbox with minimal filesystem, credential, and network access. 5. Remove the automatic `pip install --upgrade pip` instruction. Package-manager upgrades should be handled separately through an audited environment-maintenance process. 6. Configure the installer to use a trusted package index and disable unexpected fallback indexes where practical. 7. Periodically review the pinned package version for known vulnerabilities and update the lockfile only after testing and integrity verification. ]]>