T08 · Insecure Dependencies
Warning
- Location
SKILL.md:111- Finding
Unsafe Runtime Dependency Installation and System-Level Package Modification
- Content
View full analysis
/dev/null || true ``` From `references/pdf-fallback.md:5`: ```text Install: `pip install reportlab --break-system-packages` ``` ### Technical Analysis The Skill instructs the agent to install multiple third-party packages dynamically without exact version constraints or integrity hashes. As a result, the effective code installed during execution is mutable and may differ from the code that was reviewed. The `--break-system-packages` option explicitly bypasses Python's externally managed environment protection. This allows `pip` to install into or alter the host Python environment rather than requiring an isolated virtual environment. Such modification can overwrite distribution-managed packages, create incompatible dependency combinations, and affect unrelated applications that use the same interpreter. Python package installation can execute package build hooks and other installation-time code under the privileges of the invoking process. Consequently, compromise of a requested package, one of its transitive dependencies, the configured package index, or package-resolution infrastructure could result in arbitrary code execution. The `apt ...[truncated 2662 chars]- Remediation
View remediation
/dev/null || true`; fail safely and provide actionable error reporting. 10. Scan locked dependencies for known vulnerabilities and review lock-file changes before deployment. 11. Keep generated charts and reports in a dedicated, permission-restricted working directory rather than a shared system location. ]]>