T08 · Insecure Dependencies
Warning
- Location
- RUNBOOK.md:195
- Finding
- Unverified and Unlocked Third-Party Dependencies in the Runtime Bootstrap<![CDATA[ ## Vulnerability Details **File Location**: `RUNBOOK.md:195-219`; additional occurrence at `SKILL.md:206` **Vulnerability Type**: Supply-chain exposure through floating dependencies and installation without artifact hash verification **Risk Level**: Medium ### Vulnerable Code Snippets `RUNBOOK.md:195-219`: ```bash micromamba create -y -n md -c conda-forge \ python=3.12 openmm=8.3.1 openmmforcefields openff-toolkit \ openff-forcefields ambertools rdkit pdbfixer mdtraj pyyaml scipy # reproducible variant (review once, reuse): after the first successful solve — # micromamba env export -n md > conda-linux-64.lock # micromamba create -y -n md --file conda-linux-64.lock # openmm=8.3.1 is the safety-critical hard pin (R02); the helper packages float by # design on an ephemeral session — pin them via the lock if you need bit-reproducibility. # sanity check: micromamba run -n md python -c "import openmm; print(openmm.__version__)" # then: micromamba run -n md python <abs path to run.py> --engine ``` The accompanying disclosure confirms that most packages are intentionally unlocked: ```text The conda env itself: only openmm=8.3.1 is safety-critical and hard-pinned; the remaining packages (openmmforcefields, openff-toolkit, ambertools, rdkit, mdtraj, …) float at conda-forge HEAD of the day. They were verified against OpenMM 8.3.1 across v34–v56, but bit-identical reproducibility requires exporting micromamba env export from a known-good session and re-creating from that spec file. ``` `SKILL.md:206`: ```bash pip install -q kaggle==2.2.4 && chmod 600 ~/.kaggle/kaggle.json # pinned CLI; user-provided key; standard hygiene ``` ### Technical Analysis The runtime environment is reconstructed during every Kaggle session. Although `openmm=8.3.1` and `kaggle==2.2.4` are version-pinned, most Conda dependencies have neither exact versions nor exact build identifiers. The resolver can therefore select different executable artifacts whenever the bootstra ...[truncated 3015 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Publish a reviewed explicit Conda lock file** - Resolve the environment from a trusted, known-good system. - Lock every package to an exact version, build identifier, platform, and repository URL. - Commit the reviewed lock file to the Skill. - Replace the floating environment creation command with: ```bash micromamba create -y -n md --file conda-linux-64.lock ``` 2. **Verify the lock file before use** - Publish the expected SHA-256 digest of the lock file in a separately reviewed manifest. - Verify the digest before creating the environment. - Treat any unexpected change to the lock file or manifest as a security-sensitive review event. 3. **Use hash-verified Python package installation** - Produce a requirements file containing the exact Kaggle CLI version and artifact hash. - Install with hash enforcement, for example: ```bash python3 -m pip install --require-hashes -r requirements-kaggle.txt ``` 4. **Reduce runtime privilege** - Prefer a user-writable installation directory such as `$HOME/.local/bin` instead of `/usr/local/bin` where practical. - Run dependency installation and the simulation as a non-root user when the Kaggle environment permits it. - Expose credentials only to the process that requires them and only for the duration of the API operation. 5. **Separate dependency installation from credential availability** - Do not make Kaggle credentials available while installing or initially importing newly resolved packages. - Complete integrity checks before exposing private datasets or authentication material. 6. **Add continuous supply-chain validation** - Generate a software bill of materials for each approved environment. - Scan locked artifacts for known vulnerabilities and unexpected provenance changes. - Require human review before updating any dependency or lock file. - Preserve known-good package artifacts or use a controlled m ...[truncated 69 chars]