T08 · Insecure Dependencies
Warning
- Location
- references/validation.md:30
- Finding
- Unverified Third-Party Dependency Installation Instructions## Vulnerability Details **File Location**: `references/validation.md`, lines 30–31 and 42–43 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code Snippets Lines 30–31: ```bash pip install -r requirements.txt playwright install chromium ``` Lines 42–43: ```bash pnpm install pnpm build ``` ### Technical Analysis The validation guide instructs the agent to install Python packages, Node.js packages, and a Playwright browser binary. The corresponding dependency manifests, lockfiles, version constraints, package sources, integrity hashes, and lifecycle scripts are not included in the audited Skill artifact and therefore could not be verified. In particular, `pnpm install` may execute dependency lifecycle scripts, while `pip install -r requirements.txt` may install packages from external registries or other sources specified by the target repository. The Playwright installation command also retrieves a browser binary. The instructions do not require frozen lockfile enforcement, hash verification, trusted-registry restrictions, lifecycle-script review, or execution in an isolated environment. This finding does not establish that any referenced dependency is currently malicious. The risk arises because the Skill recommends executing installation operations without first requiring verification of the external dependency definitions and resolved artifacts. ### Attack Path 1. An agent invokes the Skill while operating in a PPTAgent or BotSlide repository. 2. The agent follows the validation instructions in `references/validation.md`. 3. The target repository contains a compromised dependency manifest, lockfile, package source, or lifecycle script. 4. The installation command resolves or installs the attacker-controlled component. 5. A malicious package installer or Node.js lifecycle script executes under the account running the agent. 6. The malicious code gains access to files, environment variables, network permissions ...[truncated 730 chars]
- Remediation
- ## Remediation Suggestions 1. Require inspection of `requirements.txt`, `package.json`, and all relevant lockfiles before installation. 2. Use reproducible, locked installation modes, such as: - `pnpm install --frozen-lockfile` - Python packages pinned to exact versions with verified hashes 3. Restrict dependency resolution to approved registries and reject unexpected URLs, Git dependencies, local path dependencies, and untrusted package sources. 4. Review package lifecycle scripts before permitting `pnpm install`; use `--ignore-scripts` when lifecycle scripts are unnecessary. 5. Verify the provenance and integrity of downloaded Playwright browser binaries. 6. Perform installations in an isolated, unprivileged container or disposable environment without production secrets. 7. Avoid exposing SSH agents, cloud credentials, API tokens, or unrelated host directories to the installation environment. 8. Add an explicit validation gate stating that installation must stop if manifests, lockfiles, or resolved sources cannot be audited.