T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Unpinned Dependencies Installed Outside an Isolated Environment<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Unsafe dependency installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install yfinance numpy --break-system-packages ``` ### Technical Analysis The installation instructions retrieve `yfinance` and `numpy` without version constraints or cryptographic hash verification. Consequently, the installed code depends on whichever releases the package index resolves at installation time rather than on versions reviewed with this skill. The `--break-system-packages` option also bypasses Python's externally managed environment protection. This can modify the system Python environment, conflict with operating-system-managed packages, and expand the effect of a compromised dependency beyond an isolated project environment. This does not establish that either named package is malicious. The vulnerability is the unsafe dependency-management process, which exposes installation to future compromised releases, malicious index configuration, or other supply-chain failures. ### Attack Path 1. An attacker compromises a referenced package release, its maintainer account, or a package index configured on the target system. 2. A user follows the documented installation command. 3. `pip3` resolves and downloads the attacker-controlled release because no reviewed version or hash is enforced. 4. Package installation hooks or later imports execute attacker-controlled Python code with the privileges of the user running the command. 5. Because system package protections are bypassed, the malicious or incompatible package can also affect other applications using the same Python environment. ### Impact Assessment Successful exploitation could execute arbitrary code with the installing user's privileges. Depending on that user's access, the attacker could read or modify user files, access available environment variables and credentials, make network ...[truncated 197 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Create and use a dedicated virtual environment instead of modifying system Python. - Remove `--break-system-packages` from the installation instructions. - Declare exact, reviewed dependency versions in a requirements or lock file. - Generate and verify cryptographic hashes, for example with `pip install --require-hashes -r requirements.txt`. - Configure an approved package index explicitly where deployment policy requires it. - Integrate dependency vulnerability and integrity scanning into release maintenance. - Document a controlled dependency-update process so upgrades are reviewed before publication. Example: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` ]]>