T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:134
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:134-138`; also documented in `README.md:36-42` **Vulnerability Type**: Unpinned dependency installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code `SKILL.md:134-138`: ```markdown Installation: ```bash pip3 install requests ``` ``` `README.md:36-42`: ```markdown ## Dependencies - Python 3 - requests ```bash pip3 install requests ``` ``` ### Technical Analysis The installation instructions retrieve `requests` without specifying an audited version, dependency lockfile, or cryptographic hashes. Consequently, the installed package and its transitive dependencies are mutable and depend on the state of the configured Python package index at installation time. This does not establish that the current `requests` package is malicious. However, it creates a supply-chain risk because a compromised upstream release, compromised package index, maliciously configured mirror, or dependency-resolution manipulation could cause users to install code that was not reviewed as part of this project. Python packages can execute code during installation through build backends and can run arbitrary code when imported. Both `scripts/epic_free.py` and `scripts/steam_free.py` import `requests`, so a substituted package would also gain an execution path whenever these scripts are invoked. ### Attack Path 1. A user follows the documented command `pip3 install requests`. 2. `pip` resolves the latest compatible package and transitive dependencies from the user's configured package index or mirror. 3. An attacker compromises an upstream release, dependency, index, or configured mirror and serves a malicious package artifact. 4. The malicious artifact executes code during installation or when the project imports `requests`. 5. The attacker's code runs with the permissions of the user executing the installation or game-deal scripts. ### Impact ...[truncated 656 chars]
- Remediation
- ## Remediation Suggestions 1. Create a reviewed dependency file that pins exact versions, including applicable transitive dependencies. 2. Generate and record cryptographic hashes for every approved package artifact. 3. Install dependencies with hash enforcement, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Generate the locked dependency set using a reproducible dependency-management tool such as `pip-tools`. 5. Configure installation to use a trusted package index and avoid untrusted mirrors or unexpected extra indexes. 6. Add automated dependency vulnerability scanning and a controlled process for reviewing and updating pinned versions. 7. Update both `SKILL.md` and `README.md` so all documented installation paths use the same locked and hash-verified dependency process. 8. Prefer installation inside a dedicated virtual environment and avoid running `pip` or these scripts with administrative privileges.