T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:11
- Finding
- Unpinned Dependency Installation Bypasses System Package Protections## Vulnerability Details **File Location**: `SKILL.md`, line 11 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install yfinance --break-system-packages ``` ### Technical Analysis The documented installation command retrieves `yfinance` without pinning an exact version or verifying package hashes. Consequently, the package and its transitive dependencies can change after the Skill has been reviewed. The `--break-system-packages` option deliberately bypasses protections for externally managed Python environments. This can modify a host-level Python installation, introduce dependency conflicts, or replace packages used by other applications. Python packages may also execute installation or build-related code, so a compromised package release or transitive dependency could run code with the permissions of the user invoking `pip3`. No evidence indicates that the current `yfinance` package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation process. ### Attack Path 1. An attacker compromises a future `yfinance` release, one of its transitive dependencies, or the relevant package distribution account. 2. The user follows the Quick Start instructions and runs the unpinned `pip3 install` command. 3. `pip3` resolves the then-current dependency versions rather than a previously audited set. 4. Malicious installation or runtime code executes with the invoking user's permissions. 5. Because system package protections were bypassed, the installation may also modify or disrupt packages shared with unrelated host applications. ### Impact Assessment Successful exploitation could provide code execution with the privileges of the user running the installation command. This may permit access to that user's files, environment variables, credentials, and network resources. It could also alter the shared Python environment and affect othe ...[truncated 250 chars]
- Remediation
- ## Remediation Suggestions 1. Create and use a dedicated virtual environment instead of modifying the system Python installation: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 2. Remove `--break-system-packages` from all installation instructions. 3. Pin `yfinance` and every transitive dependency to reviewed, exact versions. 4. Record cryptographic hashes in a lock file or hash-checked requirements file and install with `--require-hashes`. 5. Use a controlled package index where practical and review dependency updates before adoption. 6. Run dependency vulnerability and provenance checks in CI whenever the lock file changes.