T08 · Insecure Dependencies
Warning
- Location
SKILL.md:26- Finding
Unpinned Dependency Is Automatically Resolved and Installed at Runtime
- Content
View full analysis
=3.10" # dependencies = ["httpx"] # /// ``` ### Technical Analysis The Skill permits `uv run` or the configured pip installer to resolve and install the latest compatible `httpx` package without an exact version, lockfile, or recorded artifact hash. The source code reviewed in this audit therefore does not completely determine which dependency code will execute during a future invocation. Although `httpx` is a legitimate package and no malicious package source was identified, unconstrained runtime resolution creates a supply-chain trust boundary. A compromised package-maintainer account, package registry, dependency release, or configured package index could cause unauthorized code to execute when the dependency is installed or imported. The exposure is especially relevant because the scripts run with access to `VENICE_API_KEY` and process user-selected text, images, audio, API-key metadata, billing information, and generated output. ### Attack Path 1. An attacker compromises the dependency publisher, package registry, distribution infrastructure, or package index used by `uv` or pip. 2. The attacker publishes or substitutes a malicious release that satisfies the unconstrained `httpx` requirement. 3. A user invokes one of the scripts through `uv run`, or the Skill installation mechanism installs `httpx`. 4. The resolve ...[truncated 1266 chars]- Remediation
View remediation
"] ``` 2. Generate and commit a dependency lockfile that records all transitive dependency versions. 3. Require cryptographic hashes for downloaded artifacts where the selected package workflow supports them. 4. Restrict dependency resolution to explicitly trusted HTTPS package indexes and prevent fallback to untrusted indexes. 5. Avoid maintaining redundant installation paths in both Skill metadata and individual scripts unless operationally necessary. 6. Run dependency installation separately from Skill execution, then execute with network-restricted and least-privileged credentials where practical. 7. Use an inference-only Venice key for ordinary media operations and expose an administrator key only to explicitly invoked administrative workflows. 8. Add automated dependency scanning and controlled update review so pinned versions are patched without returning to unconstrained resolution. ]]>