T08 · Insecure Dependencies
- Location
scripts/extract_pdf_images.py:15- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/extract_pdf_images.py:15andscripts/extract_pdf_images.py:24-27
Related Locations:SKILL.md:32-33,SKILL_full_backup.md:34-35
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: LowVulnerable Code
python pip install PyMuPDFThe script later imports the package and, when it is unavailable, directs the user to install it without a version constraint:
python try: import fitz # PyMuPDF except ImportError: print("Error: PyMuPDF must be installed") print("Run: pip install PyMuPDF") sys.exit(1)The Skill documentation also specifies only broad minimum versions:
text PyMuPDF (fitz) >= 1.23 openpyxl >= 3.1Technical Analysis
The installation instruction allows pip to resolve the latest available package from the environment's configured package index. No exact versions, package hashes, lockfile, or explicitly trusted index are provided. Consequently, installations are not reproducible and package integrity is not independently verified.
Although
PyMuPDFandopenpyxlare established packages and no malicious dependency is currently embedded in the project, this installation model exposes users to supply-chain compromise. A compromised package release, configured mirror, dependency, or package-index account could cause attacker-controlled code to be installed and subsequently executed when imported or used.Attack Path
- An attacker compromises a relevant package release, transitive dependency, package-index account, or package mirror used by the victim.
- A user follows the Skill's instruction and executes
pip install PyMuPDF, or installs dependencies based on the documented minimum-version constraints. - Pip resolves and downloads the compromised package because no reviewed version or cryptographic hash is enforced.
- Attacker-co ...[truncated 909 chars]
- Remediation
View remediation
Remediation Suggestions
- Create a dependency lock file containing exact, reviewed versions of
PyMuPDFandopenpyxl. - Generate and enforce cryptographic hashes for every package and transitive dependency, for example:
bash python -m pip install --require-hashes -r requirements.txt - Use an explicitly configured trusted package index or an internally controlled artifact repository.
- Replace the generic installation instruction with a reference to the locked requirements file.
- Periodically scan pinned dependencies for known vulnerabilities and update them through a reviewed process.
- Install dependencies in an isolated virtual environment without administrative privileges.
- Where feasible, verify downloaded artifacts against approved hashes before installation.
- Create a dependency lock file containing exact, reviewed versions of