T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:235
- Finding
- Unpinned Third-Party Dependencies in OCR Installation Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 234–237 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```python ### Extract Text from Scanned PDFs ```python # Requires: pip install pytesseract pdf2image import pytesseract from pdf2image import convert_from_path ``` ### Technical Analysis The OCR guidance instructs users or agents to install `pytesseract` and `pdf2image` without specifying reviewed versions, package hashes, a lockfile, or an approved package index. Consequently, package resolution depends on the current contents of the configured Python package repository and may produce different dependency trees over time. This installation is not automatically performed by a bundled script; it is documentation that may be followed when OCR functionality is requested. Nevertheless, following the instruction can introduce supply-chain exposure. If a package release, transitive dependency, configured package index, or package-resolution environment is compromised, attacker-controlled code could execute during installation or when the dependency is imported. ### Attack Path 1. A user requests OCR or text extraction from a scanned PDF. 2. The agent follows the prerequisite in `SKILL.md`. 3. The agent runs `pip install pytesseract pdf2image` without version or hash verification. 4. `pip` resolves the packages and their transitive dependencies from the configured package index. 5. A compromised package release, dependency, or index response supplies attacker-controlled code. 6. Malicious code executes during package installation or subsequent import with the privileges of the account running the agent. Successful exploitation requires compromise or manipulation of the dependency supply chain or package-resolution environment; the audited project does not itself contain such a payload. ### Impact Assessment If the dependency supply chain is compromised, arbitrary code ...[truncated 547 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency lock file containing exact versions for all direct and transitive Python dependencies. 2. Generate and verify cryptographic hashes for every package artifact, then install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Replace the unpinned command with installation instructions referencing the locked requirements file. 4. Require an approved HTTPS package index and disable unintended fallback indexes: ```bash python -m pip install \ --index-url https://approved.example/simple \ --no-extra-index-url \ --require-hashes \ -r requirements.txt ``` 5. Review and periodically update pinned dependencies through a controlled process that includes vulnerability scanning, provenance verification, and functional testing. 6. Install dependencies in an isolated virtual environment or container with minimal filesystem permissions, no unnecessary secrets, and restricted network access. 7. Prefer prebuilt, internally validated environments where OCR dependencies are installed before untrusted PDFs are processed. ]]>