T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party Dependencies Allow Supply-Chain Substitution## Vulnerability Details **File Location**: `SKILL.md`, lines 15–17 **Additional Location**: `README.md`, lines 21–24 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - Python 3.7+ - Dependencies: `python-docx` (required), `pywin32` (required only for reading .doc files on Windows), `lxml` - Installation command: `pip install python-docx lxml pywin32` ``` The same unpinned installation command is repeated in `README.md`: ```bash pip install python-docx lxml pywin32 # pywin32 is required only on Windows ``` ### Technical Analysis The documented installation command resolves mutable third-party packages by name without version constraints or cryptographic hashes. It also does not specify a trusted package index. Consequently, the code installed by users can differ from the dependencies that were implicitly considered during this audit. If the configured package index, a dependency release, or the dependency-resolution environment is compromised, `pip` may install attacker-controlled code. Such code can execute during package installation or when the project imports the package. The scripts directly import `docx` and `lxml`-backed functionality, making installed dependency code part of the Skill's effective execution path. The command also installs `pywin32` unconditionally even though it is documented as necessary only on Windows. This unnecessarily expands the dependency and attack surface on environments where it is not required. This finding establishes unsafe dependency-management guidance. It does not establish that the currently published packages are malicious. ### Attack Path 1. A user loads the Skill and follows its prerequisite installation instructions. 2. The user runs `pip install python-docx lxml pywin32`. 3. `pip` resolves package versions from the user's configured package index without enforcing reviewed versions or hashes. 4. An attacker compromises a resolved package ...[truncated 956 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to a reviewed version rather than allowing unconstrained resolution. 2. Generate a lock or requirements file containing cryptographic hashes, and install it with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Document and enforce a trusted package index, especially in automated environments. 4. Apply a platform marker to `pywin32` so it is installed only on Windows: ```text pywin32==<reviewed-version> ; sys_platform == "win32" ``` 5. Review and pin transitive dependencies through a reproducible dependency-locking process. 6. Run dependency vulnerability and provenance checks in CI, and update pinned versions through a controlled review process. 7. Install dependencies in an isolated virtual environment under a non-privileged account. 8. Replace the unpinned commands in both `SKILL.md` and `README.md` with the hardened installation procedure.