T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:92
- Finding
- Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 92 **Additional Location**: `scripts/transform_coords.py`, lines 14-18 **Vulnerability Type**: Unpinned and unverifiable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install pyproj ``` The runtime import handling also directs users to execute the same unpinned installation command: ```python try: from pyproj import Transformer except ImportError: print("Error: the pyproj library must be installed") print("Run: pip3 install pyproj") sys.exit(1) ``` ### Technical Analysis The installation instructions retrieve `pyproj` without a fixed version, cryptographic hash, dependency lockfile, or explicitly trusted package source. Consequently, the code ultimately installed depends on whichever release and transitive dependencies the package index resolves at installation time. This makes the reviewed Skill non-reproducible and exposes users to supply-chain risks. If the upstream package, a transitive dependency, a configured package index, or the user's package-resolution environment is compromised, installation may retrieve code that was not part of this audit. Python packages can execute code during installation and subsequently when imported by `transform_coords.py`. No evidence was found that the current `pyproj` package is malicious. The vulnerability is the absence of controls ensuring that users install the same reviewed dependency artifact. ### Attack Path 1. An attacker compromises the relevant package distribution account, package-index route, configured mirror, or a transitive dependency. 2. The attacker publishes or serves a malicious release that satisfies the unrestricted `pyproj` installation request. 3. A user follows the documented `pip3 install pyproj` command. 4. Pip resolves and installs the attacker-controlled artifact because no version or hash constraints are present. 5. Malicious code executes during pac ...[truncated 786 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `pyproj` to a specifically reviewed version rather than installing an unrestricted latest release. 2. Maintain dependencies in a version-controlled requirements or lock file. 3. Record and verify cryptographic hashes for all dependency artifacts. For example, use: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Generate the lock file from a trusted environment and review updates before changing pinned versions or hashes. 5. Use an explicitly trusted package index and avoid untrusted or ambiguously configured mirrors. 6. Install the dependency in a dedicated virtual environment under a non-privileged account rather than using system-wide or elevated installation. 7. Update both `SKILL.md` and the import-error guidance in `scripts/transform_coords.py` so they reference the same locked installation procedure. 8. Add automated dependency vulnerability and integrity checks to the release process. ]]>