T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Packages Installed Outside an Isolated Environment## Vulnerability Details **File Location**: `SKILL.md`, lines 10–11, 32, and 201 **Vulnerability Type**: Supply-chain exposure through mutable dependencies and unsafe system-environment installation **Risk Level**: Medium ### Vulnerable Code Lines 10–11: ```markdown - yt-dlp: `py -m pip install yt-dlp` - bilix (备用): `pip install bilix --break-system-packages` ``` Line 32: ```bash pip install bilix --break-system-packages ``` Line 201: ```bash # 1. 安装 bilix pip install bilix --break-system-packages ``` ### Technical Analysis The instructions install `yt-dlp` and `bilix` from the configured Python package index without pinning reviewed versions or verifying package hashes. Consequently, the effective package and transitive dependency contents can change after the Skill has been audited. The `--break-system-packages` option additionally bypasses the protection for externally managed Python environments. This can install or replace packages in an interpreter managed by the operating system, increasing the potential for dependency conflicts and damage to other applications using that interpreter. A malicious or compromised package release, compromised transitive dependency, package-index account takeover, or untrusted configured package index could introduce attacker-controlled code. Depending on the package format and installation process, such code could run during package building or later when the installed package is invoked. ### Attack Path 1. An agent or user follows the dependency instructions in `SKILL.md`. 2. `pip` resolves the latest available package versions and their transitive dependencies from the configured package index. 3. A compromised release, malicious dependency, or untrusted index supplies attacker-controlled package content. 4. The content is installed without version or cryptographic hash verification. 5. Attacker-controlled code executes during a source-package build or wh ...[truncated 835 chars]
- Remediation
- ## Remediation Suggestions 1. Create and activate a dedicated virtual environment before installing dependencies: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --upgrade pip ``` 2. Remove `--break-system-packages` from every installation command. 3. Pin reviewed versions of all direct and transitive dependencies in a lock file. 4. Generate and verify cryptographic hashes, then install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Configure an explicitly trusted package index and disable unexpected additional indexes to reduce dependency-confusion exposure. 6. Review package provenance and release integrity before updating pinned versions. 7. Run downloading and media-processing tools as a non-privileged user with access limited to the required input and output directories. 8. Add the referenced processing script and locked dependency manifest to the reviewed project rather than directing users to locate unofficial replacement files.