T08 · Insecure Dependencies
- Location
SKILL.md:27- Finding
Unpinned Third-Party Package Installation and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:27
Additional Location:README.md:34
Vulnerability Type: Unpinned executable dependency
Risk Level: MediumVulnerable Code Snippet
From
SKILL.md:27:markdown 1. **nano-pdf** — `pip install nano-pdf` (or use `uvx nano-pdf` to run without installing)The same unsafe installation guidance appears in
README.md:34:markdown - **nano-pdf**: `pip install nano-pdf`Technical Analysis
The skill instructs the agent to retrieve and execute the
nano-pdfpackage without specifying an exact version, cryptographic hash, lockfile, or verified distribution source. Bothpip install nano-pdfanduvx nano-pdfmay resolve to the latest package available from the configured Python package index.Because the repository does not contain the implementation of this dependency, the behavior executed at runtime is not fixed to the version reviewed during this audit. A compromised package release, package-index account, dependency, or configured package mirror could therefore introduce arbitrary code after the skill itself has been reviewed.
The risk is amplified by the dependency's intended access to:
- User-provided PDF documents.
- Generated and temporary document content.
- The
GEMINI_API_KEYenvironment variable. - Files and resources accessible to the user running the agent.
No evidence establishes that the current
nano-pdfpackage is malicious. The confirmed issue is the unsafe, unpinned dependency acquisition and execution process.Attack Path
- An attacker compromises the package publisher, a transitive dependency, the configured package index, or a package mirror.
- The attacker publishes or serves a malicious version under the expected package name.
- The agent follows the skill instructions and executes
pip install nano-pdforuvx nano-pdf. - The package manager retrieves the attacker-controlled release because no exact version or integrity hash is ...[truncated 1202 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin
nano-pdfto an exact version that has been reviewed:bash python3 -m pip install "nano-pdf==<audited-version>" -
Require package integrity verification using hashes in a requirements file:
text nano-pdf==<audited-version> --hash=sha256:<verified-hash>Install it with:
bash python3 -m pip install --require-hashes -r requirements.txt -
Pin and verify all transitive dependencies through a generated lockfile rather than only constraining the top-level package.
-
Document the canonical package registry, project repository, expected publisher, and verified package digest so that similarly named or substituted packages can be detected.
-
Do not automatically install missing dependencies. Request explicit user approval and display the exact package version and source before installation.
-
Run the package in a restricted environment with:
- A dedicated virtual environment or isolated container.
- Access only to the PDF files required for the operation.
- No unrelated credentials in the process environment.
- Restricted filesystem permissions.
- Network access limited to required service endpoints.
-
Update both
SKILL.mdandREADME.mdso they provide identical pinned and integrity-checked installation instructions. -
Establish a controlled dependency-update process in which new versions are reviewed, tested, and assigned new verified hashes before the documented pin is changed.
-