T08 · Insecure Dependencies
Error
- Location
install.sh:19- Finding
Automatic Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
/dev/null || { echo "⚠ 部分依赖安装失败，请手动安装：" echo " pip3 install akshare pandas numpy pyyaml" } ``` The documentation also recommends installing additional unpinned packages: ```bash pip3 install efinance pip3 install yfinance pip3 install pillow pip3 install google-generativeai ``` ### Technical Analysis The installation script retrieves mutable package versions from the package index without: - Exact version constraints - Cryptographic hashes - A reviewed lockfile - An isolated virtual environment - Explicit package-index restrictions - Dependency provenance verification Python package installation can execute package build and installation logic. Consequently, the selected packages and their transitive dependencies receive code execution under the account running the installer. Redirecting standard error to `/dev/null` also suppresses package resolver, certificate, build, and installation diagnostics. This makes supply-chain anomalies and dependency substitution harder to detect. The behavior is related to the Skill's declared need for market-data libraries, but it exceeds the minimum safe installation privilege because unrestricted current releases are installed directly into the active Python environment. ### Attack Path 1. An attacker compromises an upstream dependency, maintainer account, package release, or transitive dependency. 2. The attacker publishes a malicious version that satisfies the unconstrained package request. 3. A user runs `install.sh` or follows one of the documented `pip3 install` commands. 4. `pip3` resolves the malicious release because no version or hash is ...[truncated 834 chars]- Remediation
View remediation