T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8-10`; additional installation examples at `SKILL.md:22, 26-27` **Vulnerability Type**: Unpinned and unverifiable third-party dependency **Risk Level**: Medium ### Complete Code Snippet ```yaml install: - kind: pip package: gsuite-sdk bins: [gsuite] ``` ```bash pip install gsuite-sdk ``` ```bash pip install gsuite-sdk[cloudrun] # Optional Secret Manager dependencies pip install gsuite-sdk[all] # All dependencies ``` ### Technical Analysis The skill directs users or agents to install `gsuite-sdk` from PyPI without specifying an audited version or cryptographic hashes. It also recommends optional dependency groups that expand the number of packages installed. The project contains no lockfile, hash-validated requirements file, vendored source, or package implementation with which to verify the installed artifacts. A Python package installation can execute package-controlled build or installation logic. Consequently, the effective code installed by these commands may change after this skill has been reviewed. The declared GitHub homepage does not cryptographically bind the downloaded PyPI artifact to the repository. This finding does not establish that the current package is malicious. It identifies a supply-chain weakness through which a compromised publisher account, malicious release, or compromised transitive dependency could introduce attacker-controlled code. ### Attack Path 1. An attacker compromises the package publisher, distribution channel, or one of the unpinned transitive dependencies. 2. The attacker publishes a malicious version or modifies an available dependency artifact. 3. A user or agent follows the skill instructions and runs `pip install gsuite-sdk`, `pip install gsuite-sdk[cloudrun]`, or `pip install gsuite-sdk[all]`. 4. The package manager resolves the uncontrolled version and downloads the attacker-controlled artifact. 5. Malicious build, installation, ...[truncated 1106 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `gsuite-sdk` to a specifically reviewed version rather than allowing unrestricted resolution. 2. Maintain a lockfile or hash-validated requirements file containing all direct and transitive dependencies. 3. Install with hash verification, such as `pip install --require-hashes -r requirements.txt`. 4. Verify the package publisher, release provenance, signatures where available, and correspondence between the reviewed source revision and the published artifact. 5. Review package build metadata and installation hooks before approving the dependency. 6. Avoid broad extras such as `[all]` unless every additional package is necessary and audited. 7. Install the package in an isolated virtual environment or sandbox under a non-privileged account. 8. Grant only the Google OAuth scopes required for the current task rather than the default scope set. 9. Protect `credentials.json`, the file referenced by `GOOGLE_CREDENTIALS_FILE`, and `tokens.db` with restrictive filesystem permissions. 10. Add automated dependency scanning and controlled update review so new versions are not adopted without security validation. ]]>