T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Third-Party Dependencies and Unrestricted Plugin Loading## Vulnerability Details **File Location**: `SKILL.md`, lines 18–20; related plugin guidance at lines 53–56, 62–64, and 82–87 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash pip install 'markitdown[all]' ``` Related plugin-loading instructions: ```bash # List installed plugins markitdown --list-plugins # Enable plugins markitdown --use-plugins path-to-file.pdf ``` ```python md = MarkItDown(enable_plugins=False) # True to enable plugins ``` ```python md = MarkItDown( enable_plugins=True, llm_client=OpenAI(), llm_model="gpt-4o", ) ``` ### Technical Analysis The skill recommends installing the latest available release of `markitdown[all]` without a version constraint, dependency lock file, package hashes, or other integrity verification. The broad `all` extra also installs more optional and transitive dependencies than may be necessary for a particular conversion task, increasing the supply-chain attack surface. The documentation additionally instructs users or agents to enable dynamically discovered plugins without requiring an allowlist, provenance verification, version pinning, or source review. Python packages and plugins can execute code during installation, import, discovery, or conversion. Consequently, a compromised package release, malicious transitive dependency, or untrusted plugin could execute with the permissions of the process running the skill. The audited project does not contain a malicious package or plugin, and no dependency compromise is demonstrated. The finding concerns unsafe dependency and plugin-management guidance that creates a conditional supply-chain execution path. ### Attack Path 1. An agent follows the skill instructions and executes `pip install 'markitdown[all]'`. 2. pip resolves the current package release and its numerous unpinned transitive dependencies. 3. An attacker compromises a f ...[truncated 1017 chars]
- Remediation
- ## Remediation Suggestions 1. Pin MarkItDown to a reviewed, known-good version instead of installing an unconstrained latest release. 2. Maintain a lock file with pinned transitive dependencies and use package hashes, such as pip's `--require-hashes`, to verify integrity. 3. Install only the format-specific extras required for the current conversion rather than the broad `[all]` dependency group. 4. Use a trusted, authenticated package index and apply controls against dependency confusion or unauthorized mirrors. 5. Keep plugins disabled by default. Require explicit user approval and an allowlist of reviewed plugin package names, versions, and hashes before enabling them. 6. Install and run the converter in an isolated virtual environment or sandbox with least-privilege filesystem permissions and restricted network access. 7. Avoid exposing unrelated secrets to the conversion process. Supply API credentials only when a user explicitly requests a feature that requires the relevant external provider. 8. Add dependency vulnerability scanning and periodic review of pinned packages to the maintenance workflow.