T08 · Insecure Dependencies
Warning
- Location
- package.json:16
- Finding
- Unpinned Python Dependencies Permit Mutable Supply-Chain Artifacts<![CDATA[ ## Vulnerability Details **File Location**: `package.json:16-21` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```json { "id": "python-deps", "kind": "python", "packages": ["pdfplumber", "requests"], "label": "Install Python dependencies" } ``` ### Technical Analysis The installation configuration specifies `pdfplumber` and `requests` without exact versions, package hashes, or a dependency lockfile. Consequently, installation resolves whichever compatible releases are available from the configured Python package source at installation time. This makes the installed code mutable after the Skill has been reviewed. A compromised package registry account, malicious replacement release, dependency-confusion condition in the installation environment, or compromised transitive dependency could introduce attacker-controlled code. Python packages may execute code during installation and are subsequently imported by `scripts/process_pdf.py`, providing another execution opportunity. The audit also found a mutable Ollama model tag in the manual installation instructions, but the pinpointed vulnerability here concerns the unpinned Python dependencies declared on lines 16-21. ### Attack Path 1. An attacker compromises a declared package, one of its transitive dependencies, or the package source used by the installation environment. 2. The attacker publishes a malicious version that satisfies the unversioned package request. 3. A user installs the Skill dependencies after that version becomes available. 4. The installer retrieves the malicious or compromised artifact because no exact version or hash is enforced. 5. Attacker-controlled code executes during package installation or when `process_pdf.py` imports the package. 6. The code runs with the privileges of the user installing or invoking the Skill. This path depends on compromise or manipulation of the dependency supply chain; the repository itsel ...[truncated 671 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct Python dependency to a reviewed, exact version, for example: ```text pdfplumber==<reviewed-version> requests==<reviewed-version> ``` 2. Generate a lockfile that includes all transitive dependencies. 3. Require cryptographic hashes during installation, such as a hash-locked requirements file used with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Configure installation to use an explicitly trusted package index and disable unintended fallback indexes. 5. Run dependency vulnerability and provenance checks in CI before publishing updates. 6. Review dependency changes explicitly rather than accepting automatic floating-version upgrades. 7. Where Ollama supports immutable model digests or artifact verification, pin and verify the required model instead of relying only on the mutable `qwen2.5:7b` tag. 8. Install and run the Skill as an unprivileged user with access restricted to the intended PDF-processing directories. ]]>