T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:26
- Finding
- Unpinned Third-Party Tweepy Dependency## Vulnerability Details **File Location**: `SKILL.md:26`, `scripts/x_publisher.py:15-19`, and `scripts/x_publisher.py:285-288` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:26`: ```bash pip3 install tweepy --user ``` `scripts/x_publisher.py:15-19`: ```python try: import tweepy TWEEPY_AVAILABLE = True except ImportError: TWEEPY_AVAILABLE = False print("⚠️ tweepy 库未安装，请先运行: pip3 install tweepy --user") ``` `scripts/x_publisher.py:285-288`: ```python if not TWEEPY_AVAILABLE: print("\n❌ 请先安装 tweepy:") print(" pip3 install tweepy --user") return ``` ### Technical Analysis The documented and programmatically displayed installation command installs `tweepy` without a version constraint or integrity hash. Consequently, the code that executes when `tweepy` is imported is determined by whichever package release the package index resolves at installation time rather than by a reviewed, reproducible dependency set. This creates a supply-chain risk: a future compromised, malicious, or unexpectedly incompatible release could execute arbitrary Python code during import or API initialization. The use of `--user` also installs the package into the user's shared Python environment rather than an isolated project environment, increasing the dependency's reach and the likelihood of affecting other Python applications run by the same user. Tweepy receives the X API key, API secret, access token, access-token secret, and optional bearer token during normal client initialization. A compromised release would therefore be positioned to read these values directly, in addition to accessing other files and environment variables available to the invoking user. ### Attack Path 1. An attacker compromises the upstream Tweepy distribution channel or causes a malicious release to become the version resolved by the package installe ...[truncated 1658 chars]
- Remediation
- ## Remediation Suggestions 1. Pin Tweepy to a specifically reviewed version in a dependency file, for example: ```text tweepy==REVIEWED_VERSION ``` 2. Generate and verify cryptographic hashes for all resolved packages. Install using a hash-locked requirements file: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Include and pin all transitive dependencies through a lock-file workflow such as `pip-tools`, rather than pinning only the direct dependency. 4. Replace the instructions and error messages with installation commands that reference the reviewed dependency file: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Avoid `--user` installation. Use a dedicated virtual environment to prevent the dependency from modifying or being inherited by unrelated user-level Python applications. 6. Review dependency updates before changing the lock file, and use automated vulnerability and provenance checks for each resolved artifact. 7. Run the publisher under a dedicated, least-privileged account or constrained environment, exposing only the X credentials and media files required for the publishing operation.