T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Code Execution
- Content
View full analysis
=4.0 pikepdf>=8.0 python-docx>=1.1 openpyxl>=3.1 python-pptx>=0.6.23 pywin32>=306 Pillow>=10.0 pyyaml>=6.0 pymupdf>=1.24 ``` The setup script installs whichever compatible releases are available at installation time: ```powershell # --------------------------------------------------------------------------- # 3. Python packages # --------------------------------------------------------------------------- Write-Step "Python packages (pip)" $req = Join-Path $scriptDir "requirements.txt" if (-not (Test-Path $req)) { Write-Error "requirements.txt not found at: $req" exit 1 } pip install -r $req --quiet Write-OK "Python packages installed" ``` The Skill manifest also declares this installation command: ```yaml install: - method: shell cmd: pip install -r requirements.txt ``` ### Technical Analysis All nine dependencies use minimum-version constraints rather than exact versions. Consequently, two installations performed at different times can resolve to different, previously unaudited package versions. The project also provides neither a lockfile nor cryptographic hashes for the expected distribution artifacts. Python package installation may execute package-controlled build or installation logic. If a compatible dependency release or its distribution account is compromised, the documented installation workflow can download and execute that changed code without any modification to this repository. Transitive dependencies are also unconstrained. The reviewed package names correspond to established packages, and no direct evidence of dependency confusion, typosquatting, or a currently malicious release was found. The vulnerability is the absence of reproducible, integrit ...[truncated 1338 chars]- Remediation
View remediation