T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:27` **Additional Location**: `README.md:34` **Vulnerability Type**: Unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:27`: ```markdown 1. **nano-pdf** — `pip install nano-pdf` (or use `uvx nano-pdf` to run without installing) ``` The same unsafe installation guidance appears in `README.md:34`: ```markdown - **nano-pdf**: `pip install nano-pdf` ``` ### Technical Analysis The skill instructs the agent to retrieve and execute the `nano-pdf` package without specifying an exact version, cryptographic hash, lockfile, or verified distribution source. Both `pip install nano-pdf` and `uvx nano-pdf` may resolve to the latest package available from the configured Python package index. Because the repository does not contain the implementation of this dependency, the behavior executed at runtime is not fixed to the version reviewed during this audit. A compromised package release, package-index account, dependency, or configured package mirror could therefore introduce arbitrary code after the skill itself has been reviewed. The risk is amplified by the dependency's intended access to: - User-provided PDF documents. - Generated and temporary document content. - The `GEMINI_API_KEY` environment variable. - Files and resources accessible to the user running the agent. No evidence establishes that the current `nano-pdf` package is malicious. The confirmed issue is the unsafe, unpinned dependency acquisition and execution process. ### Attack Path 1. An attacker compromises the package publisher, a transitive dependency, the configured package index, or a package mirror. 2. The attacker publishes or serves a malicious version under the expected package name. 3. The agent follows the skill instructions and executes `pip install nano-pdf` or `uvx nano-pdf`. 4. The package manager retrieves the attacker-controlled release because no exact version or integrity hash is ...[truncated 1202 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `nano-pdf` to an exact version that has been reviewed: ```bash python3 -m pip install "nano-pdf==<audited-version>" ``` 2. Require package integrity verification using hashes in a requirements file: ```text nano-pdf==<audited-version> --hash=sha256:<verified-hash> ``` Install it with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Pin and verify all transitive dependencies through a generated lockfile rather than only constraining the top-level package. 4. Document the canonical package registry, project repository, expected publisher, and verified package digest so that similarly named or substituted packages can be detected. 5. Do not automatically install missing dependencies. Request explicit user approval and display the exact package version and source before installation. 6. Run the package in a restricted environment with: - A dedicated virtual environment or isolated container. - Access only to the PDF files required for the operation. - No unrelated credentials in the process environment. - Restricted filesystem permissions. - Network access limited to required service endpoints. 7. Update both `SKILL.md` and `README.md` so they provide identical pinned and integrity-checked installation instructions. 8. Establish a controlled dependency-update process in which new versions are reviewed, tested, and assigned new verified hashes before the documented pin is changed.