T08 · Insecure Dependencies
- Location
scripts/compare.py:17- Finding
Automatic Installation of Unpinned Dependencies at Runtime
- Content
View full analysis
Vulnerability Details
File Location:
scripts/compare.py, lines 17–24
Vulnerability Type: Unsafe runtime dependency installation
Risk Level: MediumVulnerable Code
python # Try to import required libraries def try_import(*packages): for pkg in packages: try: __import__(pkg) except ImportError: os.system(f'pip install {pkg} -q') try_import('python-docx', 'PyMuPDF', 'PIL', 'pytesseract')Technical Analysis
The script automatically invokes
pip installwhen an import attempt fails. Package versions and artifact hashes are not pinned, so the code installed and executed depends on the current state of the configured Python package index and dependency resolution process.Python package installation can execute package build logic and may introduce executable modules that are subsequently imported by the application. Consequently, compromise of a named package, one of its transitive dependencies, the configured package repository, or the package-resolution path could result in arbitrary code execution under the account running the Skill.
The package names are also used incorrectly as import names in several cases. For example, the distribution
python-docxis normally imported asdocx, andPyMuPDFis commonly imported asfitzorpymupdf. These mismatches can cause failed import checks and unnecessary repeated installation attempts.Although the package names in this particular call are fixed constants rather than user input, using
os.systemfor dependency management unnecessarily invokes a shell and makes the installation process less controlled and auditable. The audit found no evidence that the project intentionally supplies a malicious package or exfiltrates data; the risk is the insecure, mutable dependency retrieval mechanism.Attack Path
- A user invokes
scripts/compare.pyto compare contract files. - One of the import checks fails, including potentially bec ...[truncated 1222 chars]
- A user invokes
- Remediation
View remediation
Remediation Suggestions
- Remove all automatic package installation from runtime application code.
- Declare dependencies in a dedicated dependency file and pin exact reviewed versions, for example:
text python-docx==<reviewed-version> PyMuPDF==<reviewed-version> Pillow==<reviewed-version> pytesseract==<reviewed-version> - Generate and enforce cryptographic hashes using a lockfile or
pip install --require-hashes. - Install dependencies during a controlled deployment step inside an isolated virtual environment or container.
- Configure deployments to use a trusted package index and restrict fallback to unapproved public or private indexes.
- Use correct module names solely for availability checks:
python required_modules = ("docx", "fitz", "PIL", "pytesseract") - If a dependency is absent, terminate with a clear error rather than modifying the environment:
python import importlib.util missing = [ name for name in required_modules if importlib.util.find_spec(name) is None ] if missing: raise RuntimeError( "Missing required modules: " + ", ".join(missing) ) - Add dependency vulnerability scanning and periodic review of direct and transitive dependencies to the release process.