T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:31
- Finding
- Unpinned Third-Party Package Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–34 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown Optional tools (auto-detected, recommendations adapt accordingly): - **pytest** — test execution (`pip install pytest`) - **mypy** or **pyright** — static type checking - **ruff** — fast linting and formatting (`pip install ruff`) ``` ### Technical Analysis The skill recommends installing `pytest` and `ruff` directly from the package index without specifying reviewed versions, cryptographic hashes, a trusted index, or an isolated environment. Package names are not typosquatted, and the audit found no evidence that these packages are currently malicious. Nevertheless, resolving mutable package names at installation time creates an avoidable supply-chain trust boundary. This behavior also conflicts with the skill's statement that it operates entirely offline: executing either displayed `pip install` command requires network access unless packages are available in a local cache or repository. A compromised upstream release, package-index account, dependency, or configured mirror could cause an attacker-controlled distribution to be installed. Python package installation may execute build backend or installation-related code, while the installed tools later process and execute project content. ### Attack Path 1. An agent or user follows the recommendation and runs `pip install pytest` or `pip install ruff`. 2. `pip` resolves the latest compatible package and transitive dependencies through the configured package index or mirror. 3. An upstream account, release artifact, transitive dependency, or package mirror has been compromised. 4. `pip` downloads and installs the attacker-controlled artifact without validating it against a project-maintained version and hash lock. 5. Malicious build or package code executes with the privileges of the user or environment running `pip`. 6. ...[truncated 1096 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not direct agents to install optional packages automatically. Require explicit user approval before initiating network access or changing the Python environment. 2. Run all optional tooling inside a dedicated virtual environment or disposable sandbox with access limited to the project directory. 3. Replace floating installation commands with reviewed, exact version pins, for example: ```bash python -m pip install pytest==<reviewed-version> ruff==<reviewed-version> ``` 4. Maintain a lock file or requirements file containing cryptographic hashes, and install it using hash enforcement: ```bash python -m pip install --require-hashes -r requirements-tools.txt ``` 5. Use an explicitly configured trusted package index or an internally controlled artifact repository rather than inheriting an arbitrary global `pip` configuration. 6. Review and lock transitive dependencies, not only the top-level packages. 7. Update the offline-operation claim to clarify that package installation requires network access unless dependencies are already supplied through a trusted local source. 8. Preserve the existing warning about running project tests only in trusted repositories or sandboxed environments, because `pytest` imports and executes repository-controlled Python code. ]]>