T08 · Insecure Dependencies
Warning
- Location
- _meta.json:14
- Finding
- Unpinned Third-Party Dependencies and Model Assets<![CDATA[ ## Vulnerability Details **File Location**: `_meta.json:14-16` (also referenced in `scripts/bg-remove.py:13-19` and `SKILL.md:85-90`) **Vulnerability Type**: Supply-chain risk from mutable third-party dependencies and automatically downloaded model assets **Risk Level**: Medium ### Vulnerable Code Snippets `_meta.json:14-16`: ```json "dependencies": { "pip": ["rembg", "pillow"] }, ``` `scripts/bg-remove.py:13-19`: ```python try: from rembg import remove from PIL import Image except ImportError: print("错误: 请先安装依赖库") print("执行: pip install rembg pillow") sys.exit(1) ``` `SKILL.md:85-90`: ```markdown ## 依赖 - Python 3.8+ - rembg - pillow - onnxruntime 首次使用会自动下载模型文件。 ``` ### Technical Analysis The project declares `rembg` and `pillow` without exact versions or cryptographic hashes. Its installation guidance similarly invokes `pip install rembg pillow` without a lock file, an approved package index, or integrity verification. Dependency resolution can therefore select mutable package releases that were not reviewed as part of this audit. The documentation also states that model files are downloaded automatically on first use, but it does not identify an approved source, pin a model revision, or prescribe checksum or signature verification. The behavior is provided by the external `rembg` dependency rather than by explicit download code in this repository; therefore, this is a supply-chain exposure rather than confirmed malicious payload retrieval by the skill itself. Python packages can execute code during installation and whenever imported. A compromised or malicious dependency release could consequently execute with the privileges of the user running the skill. An unverified model artifact could also affect processing integrity or exploit vulnerabilities in the model-loading stack. ### Attack Path 1. An attacker compromises an upstream package account, distribution channel, model host, or relevant dependency release. 2. ...[truncated 1403 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed, exact version rather than accepting the latest available release. 2. Generate a lock file containing hashes for all direct and transitive dependencies, for example with `pip-compile --generate-hashes`. 3. Install with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. 4. Use a controlled package index or internal artifact repository and explicitly configure the approved index URL. 5. Add `onnxruntime` to the managed dependency lock if it is required at runtime, rather than documenting it separately without a version. 6. Pin model names to reviewed revisions and document their expected source URLs, versions, licenses, and cryptographic checksums. 7. Verify model checksums or signatures before loading them, and reject artifacts that fail verification. 8. Prefer pre-fetching and validating dependencies and model files during a controlled build process instead of downloading mutable artifacts on first execution. 9. Run dependency installation and image processing in a restricted environment with minimal filesystem and network access. 10. Add automated dependency vulnerability and provenance checks to the release process. ]]>