T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:204
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, line 204 **Vulnerability Type**: Unpinned dependency resolved from an unspecified package source **Risk Level**: Medium ### Evidence ```markdown - Python 3.10+ with `openpyxl` (`pip install openpyxl`) ``` ### Technical Analysis The documented installation command does not pin `openpyxl` to a reviewed version and does not verify the package with an integrity hash. It also relies on the package manager's configured index rather than explicitly identifying an approved source. Consequently, the installed artifact can change after the Skill has been reviewed. A compromised upstream release, malicious package-index configuration, or dependency-resolution attack could cause users to install code that was not part of this audit. Python packages may execute installation or build logic during installation, and their modules execute within the intended pipeline's process when imported. The referenced pipeline script is absent from the audited project, so actual dependency imports and runtime protections could not be verified. Exploitation therefore depends on a user following the documented installation instruction and resolving a malicious or compromised package artifact. ### Attack Path 1. An attacker compromises a release or distribution path used to resolve `openpyxl`, or influences the victim's configured Python package index. 2. A user follows the documented `pip install openpyxl` instruction. 3. Because no exact version or integrity hash is required, `pip` resolves and installs the attacker-controlled or compromised artifact. 4. Malicious installation logic executes during package installation, or malicious module code executes when the intended month-end-close pipeline imports the package. 5. The payload operates with the privileges of the user running `pip` or the pipeline and can access data and credentials available to that process. ### Impact Assessment Succe ...[truncated 656 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `openpyxl` to an exact, reviewed version rather than installing the latest available release. 2. Place dependencies in a committed lock or requirements file with cryptographic hashes, and install with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. 3. Explicitly use an approved package index and prevent fallback to untrusted extra indexes. 4. Review and update dependency pins through a controlled process that includes vulnerability scanning and artifact verification. 5. Install dependencies in an isolated virtual environment under a non-privileged account. 6. Include the referenced pipeline implementation in the reviewed project so its dependency use and handling of QBO credentials and financial data can be audited.