T08 · Insecure Dependencies
Warning
- Location
SKILL.md:9- Finding
Unpinned Third-Party Package Downloaded and Executed Through uvx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 9–22
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: MediumVulnerable Code
markdown Convert files to Markdown using `uvx markitdown` — no installation required. ## Basic Usage ```bash # Convert to stdout uvx markitdown input.pdf # Save to file uvx markitdown input.pdf -o output.md uvx markitdown input.docx > output.md # From stdin cat input.pdf | uvx markitdowntext ### Technical Analysis The documented commands use `uvx` to resolve, download, cache, and execute the third-party `markitdown` package at runtime. The package is referenced only by name, without an exact version, cryptographic hash, lock file, or verified artifact source. Consequently, the code executed by the Skill can change after the Skill itself has been reviewed. If the upstream package, its publication account, package repository, or a transitive dependency is compromised, a later invocation could download and execute attacker-controlled code. This represents a supply-chain trust weakness rather than evidence that the current `markitdown` package is malicious. The package processes potentially sensitive local documents and therefore may receive access to file contents. It also executes with the filesystem, network, and process privileges of the user or Agent invoking `uvx`. ### Attack Path 1. An attacker compromises the upstream package, a maintainer account, the dependency distribution channel, or a transitive dependency. 2. The attacker publishes a malicious release that can be selected by the unversioned `uvx markitdown` command. 3. A user asks the Agent to convert a supported document. 4. The Agent follows `SKILL.md` and invokes `uvx markitdown` without a pinned version or integrity verification. 5. `uvx` resolves and executes the attacker-controlled package code. 6. The malicious code runs with the invoking user's permiss ...[truncated 779 chars]- Remediation
View remediation
Remediation Suggestions
- Pin
markitdownto a specifically reviewed version in every command, using syntax supported by the selected package runner. - Lock all transitive dependencies and verify package artifacts with trusted cryptographic hashes or signatures.
- Install dependencies from an explicitly trusted package index rather than relying on implicit resolver configuration.
- Re-review and deliberately update the pinned version instead of automatically accepting newly published releases.
- Run document conversion in an isolated environment with:
- Access limited to the specific input and output files.
- No access to unrelated home-directory files or credentials.
- Network access disabled unless conversion explicitly requires it.
- A non-privileged user account.
- CPU, memory, execution-time, and output-size limits.
- Avoid enabling third-party plugins unless each plugin and its dependency tree is separately pinned and reviewed.
- Document that the first invocation downloads executable dependencies so users can make an informed trust decision.
- Pin