T08 · Insecure Dependencies
Warning
- Location
scripts/parallel_transcribe.py:2- Finding
Mutable Third-Party Dependency Installed During Runtime
- Content
View full analysis
=3.10" # dependencies = [ # "faster-whisper>=1.0.0", # ] # /// ``` The dependency declaration is automatically processed through: ```python # Try uv run first, then fall back to direct python cmd_uv = ["uv", "run", transcribe_script, audio_path, "-o", output_dir] cmd_py = [sys.executable, transcribe_script, audio_path, "-o", output_dir] try: subprocess.run(cmd_uv, check=True) except (subprocess.CalledProcessError, FileNotFoundError): print("uv not available, trying direct Python execution...") ``` ### Technical Analysis The Whisper fallback executes `uv run` against a script containing inline dependency metadata. This can cause `uv` to resolve and install `faster-whisper` and its transitive dependencies at runtime. The constraint `faster-whisper>=1.0.0` is open-ended and does not provide an exact version, an upper bound, a reviewed lockfile, or artifact hashes. Consequently, the code executed during one Skill run can differ from the code reviewed during the audit. A compromised future package version, compromised transitive dependency, or compromised package index could introduce arbitrary code into the runtime environment. This is a supply-chain weakness rather than evidence that the current `faster-whisper` package is malicious. ### Attack Path 1. The user requests a full resource pack or AI summary. 2. Manual and automatically generated subtitle acquisition fail. 3. `download_subtitles()` enters the local Whisper fallback. 4. The downloader invokes `uv run scripts/parallel_transcribe.py`. 5. `uv` resolves the open-ended `faster-whisper>=1.0.0` requirement and its transitive dependencies. 6. If a resolved package or distribution artifact has be ...[truncated 634 chars]- Remediation
View remediation