T08 · Insecure Dependencies
Warning
- Location
- scripts/file_download.py:129
- Finding
- Automatic Installation of Unpinned Third-Party Packages<![CDATA[ ## Vulnerability Details **File Location**: `scripts/file_download.py:129-147` **Vulnerability Type**: Automatic installation and execution of unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```python def _pip_install(*packages: str): """Install packages via pip if not already present.""" subprocess.run( [sys.executable, "-m", "pip", "install", *packages], check=True, capture_output=True, ) def _ensure_import(module_name: str, pip_name: str | None = None): """Import a module, auto-installing via pip if missing.""" import importlib try: return importlib.import_module(module_name) except ImportError: pip_pkg = pip_name or module_name print(f"{pip_pkg} not found, installing via pip...", file=sys.stderr) _pip_install(pip_pkg) return importlib.import_module(module_name) ``` ### Technical Analysis When a PDF-processing module is unavailable, the Skill automatically invokes pip and installs the corresponding package from the Python environment's configured package index. The dependencies are not constrained to reviewed versions, protected by package hashes, or installed into a dedicated isolated environment. Package installation and subsequent import execute third-party code. Consequently, the effective code executed by the Skill can change after the Skill itself has been audited. The risk is affected by the integrity of the configured package index, dependency releases, transitive dependencies, and local pip configuration. This behavior is not required for the core file-download operation and exceeds the minimum actions necessary to download a Lark/Feishu file. It also modifies the active Python environment without obtaining explicit approval at execution time. ### Attack Path 1. A user invokes the file-download script for a PDF or requests text/image extraction. 2. One of the req ...[truncated 1035 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove runtime pip installation from document-processing code. 2. Declare all dependencies at Skill installation time using exact, reviewed version pins. 3. Use a lockfile and require cryptographic hashes for downloaded distributions. 4. Install dependencies inside a dedicated virtual environment rather than modifying the user's active Python environment. 5. Use an explicitly trusted package index and disable untrusted additional indexes. 6. Separate file downloading from optional PDF processing so downloading remains available without installing parsing libraries. 7. If runtime installation must remain, display the exact package, version, source, and expected changes, then require explicit user confirmation before proceeding. 8. Regularly review and update pinned dependencies through a controlled security-update process. ]]>