T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:176
- Finding
- Unpinned Third-Party Python Dependencies## Vulnerability Details **File Location**: `SKILL.md`, line 176 **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```python # Requires: pip install pytesseract pdf2image ``` ### Technical Analysis The OCR example instructs users or an AI agent to install `pytesseract` and `pdf2image` without specifying reviewed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Dependency resolution can therefore change over time even though the reviewed skill content remains unchanged. If an upstream package release or configured package source is compromised, following this instruction could install attacker-controlled code. Python packages may execute code during installation or later when imported by the OCR example. ### Attack Path 1. An attacker compromises a future release of one of the named packages, its distribution account, or a package source configured in the execution environment. 2. A user or agent follows the OCR instructions and runs `pip install pytesseract pdf2image`. 3. `pip` resolves the unpinned dependency to the compromised release. 4. Attacker-controlled package code executes during installation or when the installed module is imported. 5. The malicious code operates with the privileges of the user or agent running the installation or OCR workflow. ### Impact Assessment Successful exploitation could allow arbitrary code execution under the installing user's privileges. Depending on the execution environment, this may expose locally accessible documents, environment variables, credentials, and writable project files. It could also permit modification of generated PDF-processing outputs or installation of additional malicious components. The skill does not itself contain or retrieve a confirmed malicious package; exploitation depends on compromise or unsafe configuration of the external dependency supply chain.
- Remediation
- ## Remediation Suggestions 1. Pin each dependency to a reviewed, exact version rather than allowing unconstrained resolution. 2. Maintain dependencies in a lockfile or requirements file containing cryptographic hashes. 3. Install with hash verification, for example using `pip install --require-hashes -r requirements.txt`. 4. Explicitly use an approved package index and disable unintended supplemental indexes to reduce dependency-confusion exposure. 5. Review package provenance, release signatures where available, maintainers, and transitive dependencies before updating pinned versions. 6. Perform installation and PDF processing in an isolated, least-privileged virtual environment or container without unnecessary access to credentials or sensitive files.