T08 · Insecure Dependencies
Note
- Location
- SKILL.md:11
- Finding
- Unpinned Third-Party Dependency Installation Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11`, `scripts/generate_report.py:7`, and `scripts/generate_report.py:14-19` **Vulnerability Type**: Unconstrained third-party dependencies and inaccurate installation documentation **Risk Level**: Low ### Vulnerable Code `SKILL.md:11`: ```markdown - **Python packages**: `generate_report.py` will auto-install `fpdf2`, `pandas`, `openpyxl` if missing ``` `scripts/generate_report.py:7`: ```python Requirements: pip install fpdf2 pandas openpyxl ``` `scripts/generate_report.py:14-19`: ```python try: from fpdf import FPDF import pandas as pd except ImportError: print("Error: Missing required packages.") print("Install with: pip install fpdf2 pandas openpyxl") sys.exit(1) ``` ### Technical Analysis The project instructs users to install `fpdf2`, `pandas`, and `openpyxl` without pinning reviewed versions or verifying package hashes. The repository contains no dependency lock file or hash-verified requirements file. An unconstrained command such as: ```bash pip install fpdf2 pandas openpyxl ``` resolves mutable package versions from the configured Python package index. If a future release is compromised, a package-index account is taken over, or the user's package index is maliciously configured, installation or subsequent import could execute attacker-controlled code with the privileges of the user running `pip` or the report generator. The documentation also states that `generate_report.py` automatically installs packages. The inspected implementation does not do so; it prints an installation command and exits. Although this discrepancy does not itself execute code, it may cause users to trust and follow an inadequately controlled dependency-installation workflow. ### Attack Path 1. A user invokes `scripts/generate_report.py` in an environment where one or more required packages are missing. 2. The import operation fails, and the script recommends running the unconstrai ...[truncated 1413 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Add a reviewed dependency file with exact versions, for example: ```text fpdf2==<reviewed-version> pandas==<reviewed-version> openpyxl==<reviewed-version> ``` 2. Generate and record cryptographic hashes for all direct and transitive dependencies, then install them with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-file workflow such as `pip-tools`, Poetry, or another reproducible dependency manager to control transitive versions. 4. Run automated dependency vulnerability and integrity checks in CI, using tools such as `pip-audit`, and review dependency updates before merging them. 5. Install dependencies inside an isolated virtual environment under a non-privileged account. Do not recommend system-wide or elevated `pip` installation. 6. Correct `SKILL.md` to state that the script detects missing dependencies and prints manual installation instructions; it does not automatically install packages. 7. Prefer a controlled package index and explicitly document the trusted source used for dependency resolution. ]]>