T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:58
- Finding
- Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24 and 58-61 **Vulnerability Type**: Unpinned dependency installation without integrity verification **Risk Level**: Medium ### Vulnerable Code ```markdown ### Dependencies - `tweepy` (pip install) ``` ```markdown ### 3. Install Dependency ```bash pip install tweepy ``` ``` ### Technical Analysis The setup instructions install `tweepy` from the configured Python package index without specifying an audited version, using a lockfile, or verifying cryptographic hashes. Consequently, the reviewed project does not uniquely determine which package and transitive dependency versions users will execute. Package installation and subsequent import can execute third-party code with the privileges of the user running the Skill. The script imports this dependency at `scripts/tweet.py:8`, and it later operates in a process containing Twitter OAuth credentials. A compromised package release, compromised package-index account, unsafe transitive dependency, or unexpectedly changed future release could therefore introduce arbitrary behavior outside the audited code. No evidence indicates that the currently published `tweepy` package is malicious. The issue is the mutable and unverifiable dependency-resolution process prescribed by the project. ### Attack Path 1. An attacker compromises the upstream package, one of its transitive dependencies, or the relevant package-index publishing account. 2. The attacker publishes a malicious release that satisfies the unrestricted package name `tweepy`. 3. A user follows the documented setup command: `pip install tweepy`. 4. `pip` resolves and installs the attacker-controlled or compromised release because no version or hash is enforced. 5. The user invokes `scripts/tweet.py`, which imports `tweepy`. 6. Malicious dependency code executes in the Twitter automation process and may access its environment, filesystem permissions, and network connectivity. ### Im ...[truncated 591 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `tweepy` and every transitive dependency to versions that have been reviewed and tested. 2. Store dependencies in a lockfile or hash-locked requirements file. 3. Require hash verification during installation, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Generate `requirements.txt` with exact versions and SHA-256 hashes using a dependency-locking tool such as `pip-tools`. 5. Install dependencies inside a dedicated virtual environment rather than the system Python environment. 6. Review and update pinned dependencies through a controlled process that includes vulnerability scanning and regression testing. 7. Avoid making Twitter credentials available during package installation. Supply them only when the audited application is executed. 8. Where feasible, restrict the runtime process’s filesystem access, network access, and operating-system privileges. ]]>