T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:19
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:19` **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash pip install pyswisseph ``` ### Technical Analysis The documented setup command installs the currently resolved version of `pyswisseph` from the user's configured pip package index. The project does not provide a version constraint, cryptographic hash, lockfile, or trusted-index restriction. Python package installation may execute package-controlled build hooks. Consequently, the effective code installed by this command can change after the Skill has been audited. Exploitation would require compromise or substitution of the dependency, its distribution account, or the configured package index. The audit found no evidence that `pyswisseph` itself is malicious; the risk arises from the unpinned and unverified installation process. ### Attack Path 1. An attacker compromises the dependency's distribution account or a pip index configured on the target system, or otherwise causes a malicious distribution to be resolved. 2. The attacker publishes or substitutes a malicious release under the resolved package identity. 3. A user follows the setup instruction and runs `pip install pyswisseph`. 4. pip downloads the attacker-controlled distribution because no reviewed version or hash is enforced. 5. Malicious package build or installation logic executes with the privileges of the user running pip. 6. The installed package may execute again when the Skill scripts import `swisseph`. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the account performing installation or running the scripts. This may expose files, environment variables, astrology input data, and credentials accessible to that account, and may allow modification of user-writable files or installed Python packages. The im ...[truncated 219 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `pyswisseph` to a specific, reviewed version rather than resolving the latest available release. 2. Publish a locked dependency file containing cryptographic hashes and install it with pip's `--require-hashes` option. 3. Generate and review hashes for every permitted distribution artifact and platform. 4. Use the official Python Package Index explicitly, or an internally controlled package mirror, where appropriate. 5. Install dependencies inside an isolated virtual environment under a non-privileged account. 6. Add automated dependency vulnerability and provenance monitoring to the release process. 7. Replace the setup command with a hardened form, such as: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` The corresponding `requirements.txt` should pin the reviewed version and include approved SHA-256 hashes.