T08 · Insecure Dependencies
- Location
requirements.txt:1- Finding
Python Dependency Installed Without Artifact Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
requirements.txt:1-10
Additional Locations:SKILL.md:108-109, 317;README.md:88
Vulnerability Type: Third-party dependency supply-chain risk
Risk Level: LowComplete Code Snippet:
text # comprehensive-divination-skill dependencies # # IMPORTANT VERSION NOTE: # The original documentation pinned `zhdate>=1.0`, but PyPI only ships # `zhdate==0.1` for Windows (the 1.0 release only published a macOS ARM wheel). # The 0.1 release provides every API this skill actually uses: # - ZhDate.from_datetime(dt) / to_datetime() # - .leap_month / .lunar_year / .lunar_month / .lunar_day # Therefore we pin to 0.1 explicitly so installs succeed on all platforms. zhdate==0.1The documented installation commands include:
bash python -m pip install zhdate==0.1 pip install -r requirements.txtTechnical Analysis
The project requires users or agents to install the executable third-party Python package
zhdatedirectly from the configured Python package index. Pinning the dependency to version0.1prevents unreviewed version upgrades, but it does not authenticate the downloaded artifact because no cryptographic hashes or independently verified package artifacts are provided.Python packages can execute code during installation, import, or normal use. Consequently, the effective code trusted by the project extends beyond the audited repository to the package-index infrastructure, the package publisher, mirrors, and the user's package-manager configuration. A compromised release artifact, malicious package-index mirror, or index-configuration redirection could cause code different from the reviewed dependency artifact to be installed under the expected version.
This finding does not establish that
zhdate==0.1is malicious. It identifies the absence of artifact-level integrity controls in a workflow that installs and imports third-party ex ...[truncated 1370 chars]- Remediation
View remediation
Remediation Suggestions
- Generate a lock file containing SHA-256 hashes for every approved distribution artifact and supported platform.
- Require hash verification during installation:
bash python -m pip install --require-hashes -r requirements.txt - Obtain hashes from independently verified artifacts rather than trusting only package-index metadata at installation time.
- Where practical, vendor and review this small dependency or maintain an internally reviewed package artifact in a controlled repository.
- Install dependencies in a dedicated, non-privileged virtual environment or container with restricted filesystem and network access.
- Avoid running pip as an administrator or root user.
- Add automated dependency provenance, vulnerability, and hash verification to release checks.
- Document the trusted package index explicitly and prohibit untrusted mirrors or
--extra-index-urlsettings in deployment environments.