T08 · Insecure Dependencies
Warning
- Location
scripts/bootstrap.py:15- Finding
Mandatory Dependency Installation Without Integrity Verification
- Content
View full analysis
None: """Check Python version and install missing pip packages. Call this once at the start of a session before any API work. Raises SystemExit if the Python version is too old. """ if sys.version_info < _MIN_PYTHON: sys.exit( f"Python >= {_MIN_PYTHON[0]}.{_MIN_PYTHON[1]} is required, " f"but current version is {sys.version.split()[0]}." ) missing: list[str] = [] for import_name, pip_spec in _REQUIRED_PACKAGES: try: __import__(import_name) except ImportError: missing.append(pip_spec) if missing: print(f"Installing missing packages: {', '.join(missing)}") # only install packages in _REQUIRED_PACKAGES, these packages are Alibaba Cloud's official SDK. subprocess.check_call( [sys.executable, "-m", "pip", "install", *missing], stdout=subprocess.DEVNULL, ) ``` ### Technical Analysis The bootstrap routine automatically installs packages from the pip index selected by the host environment. Package versions are pinned, which reduces accidental version drift, but the installation does not use cryptographic package hashes or an explicitly controlled package repository. The Skill instructions require this bootstrap operation to run before API work. Consequently, an attacker who controls the effective pip configuration, a configured mirror, DNS or repository infrastructure, or a package release channel could potentially substitute a malicious distribution with the expected packa ...[truncated 1342 chars]- Remediation
View remediation