T08 · Insecure Dependencies
Warning
- Location
SKILL.md:34- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
``` ### Technical Analysis The documented installation command installs `openpyxl` without a pinned version, cryptographic hashes, a lockfile, or an explicitly trusted package source. Consequently, dependency resolution is mutable: different users or installation dates may retrieve different package versions and transitive dependencies. Although the audit found no evidence that `openpyxl` itself is malicious, this installation pattern creates a supply-chain exposure. A compromised package release, package index, dependency, or future incompatible version could introduce unauthorized behavior. Python package installation may execute package build logic, while the installed library will subsequently process sensitive bank statements and generate financial workbooks. The referenced QBO client is not included in the audited project, so its implementation, dependency integrity, credential handling, and network behavior could not be verified. ### Attack Path 1. A user follows the installation instructions and runs `pip install openpyxl`. 2. `pip` resolves the current package release and any required dependencies from its configured index without checking project-provided hashes or a lockfile. 3. An attacker compromises a resolved package release, dependency, package repository, or the user's configured package source. 4. Malicious code executes during package installation or when the reconciliation pipeline imports the affected component. 5. The code runs with the privileges of the user invoking `pip` or the pipeline and may access files, environment variables, bank statement data, generated workbooks, and any credentials available to that process. This path is ...[truncated 856 chars]- Remediation
View remediation
\ --hash=sha256: ``` 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Configure an explicitly trusted package index and prevent unintended resolution through user-controlled or untrusted indexes. 5. Prefer installation inside a dedicated virtual environment with only the permissions required to perform reconciliation. 6. Subject dependency updates to automated vulnerability scanning, review, and reproducible build checks before changing pinned versions. 7. Include the expected QBO client implementation in the auditable project, or document its exact repository, version, integrity digest, required permissions, and credential-storage behavior. 8. Ensure the reconciliation process receives only the minimum file and credential access necessary for its stated operation. ]]>