T08 · Insecure Dependencies
Note
- Location
- SKILL.md:99
- Finding
- Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:99` - `references/fulltext_chinese.md:38` **Vulnerability Type**: Uncontrolled third-party dependency versions **Risk Level**: Low ### Vulnerable Code Snippets `SKILL.md:99`: ```text 4. **For PDF/document content**: Extract the body text before archiving (pypdf is recommended: `pip install pypdf`); skip scanned documents when text cannot be extracted. ``` `references/fulltext_chinese.md:38`: ```text | **jieba tokenization** | `jieba.lcut("煤炭期货价格")` → `["煤炭","期货","价格"]` | Requires `pip install jieba` | ``` ### Technical Analysis The Skill recommends installing `pypdf` and `jieba` directly from the package index without specifying reviewed versions, hashes, a lock file, or an isolated environment. Consequently, the code installed by an agent or user may differ from the code that existed when the Skill was audited. This is a supply-chain hardening weakness rather than evidence that either named package is currently malicious. Exploitation would require compromise of the package distribution channel, a malicious future release, or another package-resolution failure. ### Attack Path 1. An attacker compromises a referenced package or its distribution channel, or publishes a malicious future version. 2. A user or agent follows the Skill instruction and runs `pip install pypdf` or `pip install jieba`. 3. The package manager resolves the unconstrained dependency to the affected release. 4. Package installation or later import executes attacker-controlled code under the privileges of the user or agent running Python. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the permissions of the installing user or agent. Depending on those permissions, the payload could read or modify project files, access user-readable data, alter the Python environment, or invoke available network and operating-system functionality. The Skill does not itself retrieve or execute a ...[truncated 177 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Define reviewed dependency versions in a requirements or lock file, for example: ```text pypdf==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH jieba==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH ``` 2. Generate and verify hashes using a dependency-locking tool such as `pip-tools`. 3. Install dependencies in an isolated virtual environment rather than the agent's global Python environment. 4. Use a trusted package index and configure package-index allowlisting where available. 5. Review dependency release notes and provenance before updating locked versions. 6. Change the documentation to direct users to the reviewed dependency file instead of issuing unconstrained `pip install` commands. ]]>