T08 · Insecure Dependencies
- Location
scripts/lib/analysis/sentiment.py:235- Finding
Unpinned Dependencies and Mutable Runtime Model Downloads
- Content
View full analysis
Vulnerability Details
File Location:
requirements.txt:1-6;scripts/lib/analysis/sentiment.py:235-254
Vulnerability Type: Supply-chain integrity weakness
Risk Level: MediumVulnerable Code
requirements.txt:1-6:text pandas>=2.0.0 pandas-ta>=0.3.14b httpx>=0.27.0 aiohttp>=3.9.0 pyyaml>=6.0 python-dateutil>=2.9.0scripts/lib/analysis/sentiment.py:235-254:python try: tokenizer = AutoTokenizer.from_pretrained( model_name, local_files_only=True, cache_dir=self.cache_dir ) model = AutoModelForSequenceClassification.from_pretrained( model_name, local_files_only=True, cache_dir=self.cache_dir ) logger.info(f"Model loaded from local cache: {model_name}") except (OSError, ValueError): # Download from Hugging Face logger.info(f"Downloading model: {model_name}") tokenizer = AutoTokenizer.from_pretrained( model_name, cache_dir=self.cache_dir ) model = AutoModelForSequenceClassification.from_pretrained( model_name, cache_dir=self.cache_dir )Technical Analysis
All Python dependencies use open-ended minimum-version constraints. There is no lockfile, package hash verification, or maximum-version constraint. Consequently, separate installations can resolve to materially different dependency sets, including future releases that were never reviewed with this project.
The sentiment analyzer also downloads models by mutable repository name when a local copy is unavailable. It does not specify a reviewed Hugging Face commit through the
revisionparameter. The effective model artifact can therefore change after the Skill package has been audited.This creates two related supply-chain risks:
- A compromised or unexpectedly incompatible future Python package release can be installed automatically.
- A ...[truncated 1656 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace open-ended dependency ranges with exact, reviewed versions.
- Generate and commit a reproducible lockfile using a tool such as
pip-tools, Poetry, oruv. - Require package hashes during installation, for example through a hash-locked requirements file and
pip install --require-hashes. - Use a controlled package index or approved internal mirror for production deployments.
- Pin every Hugging Face model to a reviewed immutable commit:
python AutoTokenizer.from_pretrained( model_name, revision="REVIEWED_COMMIT_SHA", cache_dir=self.cache_dir ) - Prefer reviewed
safetensorsartifacts and reject legacy serialization formats where practical. - Download and verify models during a controlled installation phase rather than implicitly during command execution.
- Provide an offline or
local_files_only=Trueproduction mode that fails safely if an approved model is unavailable. - Add dependency and model-artifact scanning to CI, including alerts for changed lockfile hashes or model revisions.