T08 · Insecure Dependencies
Warning
- Location
scripts/zotero_tool.py:237- Finding
Mandatory Runtime Installation of an Unpinned Dependency
- Content
View full analysis
=2.31.0"], capture_output=True, text=True) if r.returncode != 0: print("dep_requests=install_failed") print((r.stderr or r.stdout or "").strip()[:500]) return 10 import importlib req_mod = importlib.import_module("requests") print(f"dep_requests=installed version={getattr(req_mod, '__version__', 'unknown')}") ``` The dependency declaration is also unpinned: ```text requests>=2.31.0 ``` The Skill instructions make this installation path part of the mandatory execution flow: ```text Required execution flow: 1. Run `doctor --auto-install-deps` 2. If successful, run `import` ``` ### Technical Analysis The `doctor --auto-install-deps` command invokes pip to retrieve and install any version of `requests` satisfying `>=2.31.0`. The package version is not pinned, no artifact hashes are verified, and no trusted package index is explicitly selected. Consequently, the code executed by the Skill can differ from the code originally audited. If dependency resolution is influenced by a compromised package repository, compromised upstream release, malicious mirror, or local pip configuration, pip may install an attacker-controlled artifact. A source distribution can involve build-backend code during installation, and the installed package is subsequently imported with `importlib.import_module("requests")`. This behavior is not required for Zotero's local import semantics. D ...[truncated 1601 chars]- Remediation
View remediation
``` 3. Generate a lock file containing cryptographic hashes and install with hash verification: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Restrict installation to a trusted, explicitly configured package index and avoid inheriting untrusted pip configuration where feasible. 5. Install dependencies in an isolated virtual environment rather than modifying the agent's or system's shared Python environment. 6. Prefer a deployment process that installs and verifies dependencies before the Skill is invoked. The runtime `doctor` command should only validate their presence and approved versions. 7. If runtime installation must remain available, display the package source and resolved version, obtain user confirmation, reject unexpected versions or indexes, and verify artifacts against maintained hashes. ]]>