T08 · Insecure Dependencies
Warning
- Location
SKILL.md:67- Finding
Unpinned Third-Party Package Installation
- Content
View full analysis
= 3.11, `LLM_PROVIDER_API_KEY` set (used by the LLM runtime). **Install:** `pip install ganglion` ``` `references/operations.md:3-8`: ```markdown ## First-Time Setup 1. **Install Ganglion:** ```bash pip install ganglion ``` ``` `references/troubleshooting.md:48-54`: ```markdown **Cause:** The `openai` Python package is not installed. **Fix:** ```bash pip install openai>=1.0 # or reinstall ganglion with all deps pip install ganglion ``` ``` ### Technical Analysis The installation instructions retrieve mutable third-party packages from the user's configured Python package index without pinning exact versions, validating package hashes, or using a reviewed lockfile. Consequently, the code ultimately executed by the Skill can change independently of the audited files. The repository does not contain the Ganglion implementation or a dependency lockfile that would allow the installed package and its transitive dependencies to be compared against a known-good artifact. The broad `openai>=1.0` constraint similarly permits future releases that were not part of this audit. This is not evidence that the named packages are currently malicious. The vulnerability is the absence of reproducible, integrity-verified dependency resolution. Relevant compromise scenarios include: - A future package release is compromised. - A transitive dependency is compromised. - The user has a malicious or incorrectly configured package index. - DNS, proxy, or repository credentials are compromised. - An unexpected package version introduces unsafe behavior. ### Attack Path 1. An attacker compromises a permitted package release, transiti ...[truncated 1226 chars]- Remediation
View remediation
" ``` 2. Generate and distribute a lockfile containing all transitive dependencies. 3. Require cryptographic hashes during installation: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 4. Document the expected package index and prevent unintended fallback to untrusted indexes: ```bash python3 -m pip install \ --index-url https://pypi.org/simple \ --require-hashes \ -r requirements.lock ``` 5. Publish expected package signatures or checksums and verify release provenance where supported. 6. Install the packages in a dedicated, non-privileged virtual environment rather than globally or as root. 7. Add automated dependency scanning and periodically regenerate the lockfile only after reviewing updates. 8. Quote the OpenAI version specifier in shell examples: ```bash python3 -m pip install "openai==" ``` Quoting also prevents the shell from interpreting `>` in `openai>=1.0` as output redirection. ]]>