T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-18 **Vulnerability Type**: Uncontrolled third-party dependency installation **Risk Level**: Medium ### Evidence ```bash ## Prerequisites 1. **DashScope API Key:** A valid key from Alibaba Cloud Bailian with `qwen-vl-max` access. 2. **Environment:** ```bash pip install pymupdf dashscope ``` ``` ### Technical Analysis The installation instructions retrieve `pymupdf` and `dashscope` from the active Python package index without pinning reviewed versions or verifying package hashes. Package versions can therefore change independently of the audited Skill. Python package installation may execute package-controlled build or installation logic. If a dependency, transitive dependency, maintainer account, or configured package index is compromised, following the documented command could execute unreviewed code with the privileges of the user running `pip`. The package names are consistent with the imports in `scripts/vision_parse.py`, and the project does not direct users to an obviously suspicious repository or similarly named package. This is therefore a supply-chain hardening issue rather than evidence that the current dependencies are malicious. ### Attack Path 1. An attacker compromises a listed dependency, one of its transitive dependencies, its publisher account, or a package index used by the victim. 2. The attacker publishes a malicious package version that still satisfies the unrestricted installation command. 3. A user follows the Skill documentation and runs `pip install pymupdf dashscope`. 4. `pip` downloads the attacker-controlled release and may execute its build or installation code. 5. The malicious package runs with the installing user's privileges and can subsequently execute again when the parser imports it. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the account installing or running the Skill. The resulting access cou ...[truncated 373 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a dependency file that pins reviewed versions, including relevant transitive dependencies. 2. Record and enforce cryptographic hashes, for example through a hash-locked requirements file and `pip install --require-hashes`. 3. Generate the lock file from a controlled package index and review dependency changes before updating it. 4. Recommend installation inside a dedicated virtual environment rather than a system-wide or privileged Python environment. 5. Add automated dependency vulnerability and provenance scanning to the release process. 6. Explicitly warn users not to run dependency installation as `root` or an administrator. ]]>