T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:29
- Finding
- Unpinned and Unverified Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 29-41 **Vulnerability Type**: Supply-chain exposure through unconstrained package installation **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install --quiet package-name ``` ```python import subprocess import sys def ensure_package(package): try: __import__(package) except ImportError: subprocess.check_call([sys.executable, "-m", "pip", "install", "--quiet", package]) ``` ### Technical Analysis The skill recommends installing packages without exact version constraints, integrity hashes, an approved package allowlist, trusted-index validation, or explicit user confirmation. The `ensure_package` helper accepts an unconstrained package name and automatically passes it to pip when the corresponding import fails. Although the subprocess call uses an argument list and is not directly vulnerable to shell command injection, pip still resolves and downloads attacker-influenced third-party content. Dependency confusion, typosquatting, a compromised upstream release, or an attacker-selected package name could therefore introduce malicious code. The use of `--quiet` further reduces the visibility of installation activity and warnings. ### Attack Path 1. An attacker or untrusted task influences the package name supplied to the documented installation command or `ensure_package`. 2. The package is absent from the current Python environment, causing the helper to invoke pip. 3. Pip searches its configured package indexes without enforcing an approved distribution, exact version, or expected hash. 4. A malicious, typosquatted, dependency-confused, or compromised distribution is downloaded and installed. 5. Malicious package behavior can execute during package installation or when the package is subsequently imported and used. 6. The payload runs with the same operating-system identity and permissions as the agent process. ...[truncated 543 chars]
- Remediation
- ## Remediation Suggestions 1. Remove automatic installation from the import fallback. Report the missing dependency and require explicit approval before changing the environment. 2. Install dependencies only inside a dedicated, least-privileged virtual environment rather than the global interpreter environment. 3. Maintain an allowlist that maps approved distribution names to their expected import names; do not pass arbitrary task-controlled strings to pip. 4. Pin every dependency to an exact reviewed version and verify package integrity with hashes, such as through a lock file or `pip install --require-hashes -r requirements.txt`. 5. Restrict pip to explicitly approved HTTPS package indexes and prevent untrusted extra indexes from participating in resolution. 6. Remove `--quiet` so that the selected source, version, dependency resolution, and warnings remain visible for review. 7. Prefer a prebuilt, reproducible environment whose dependencies are reviewed before agent execution. 8. If runtime installation is unavoidable, display the resolved package name, version, source, and hashes and obtain user confirmation before installation.