T08 · Insecure Dependencies
- Location
SKILL.md:255- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 255-261
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: MediumVulnerable Code Snippet
markdown ### Dependency Details | Dependency | Type | Required | Installation | |:------|------:|:------|:------| | LLM API | API | Required | Provided by the Agent platform (free edition routes to GPT-4o-mini) | | chardet | Python library | Recommended | `pip install chardet` (encoding detection) | | csv | Python module | Required | Python standard library; no installation required | | json | Python module | Required | Python standard library; no installation required |Technical Analysis
The Skill recommends installing
chardetdirectly from the user's configured Python package index without specifying a reviewed version, cryptographic hashes, or a trusted package source. Consequently, the dependency resolved at installation time can differ from the component that was reviewed during the audit.The package name is legitimate and there is no evidence that the project intentionally references a malicious dependency. However, the unrestricted installation command creates a supply-chain exposure if the configured index, dependency distribution, package maintainer account, or local package resolution configuration is compromised.
Python packages may execute code during installation or when imported. A malicious dependency release could therefore run code with the privileges of the user or Agent executing the conversion workflow.
Attack Path
- An attacker compromises the dependency publisher, the configured package index, or the user's package resolution path.
- The attacker makes a malicious
chardetdistribution available through that source. - A user or Agent follows the documented
pip install chardetinstruction. - Because no version or hash is specified, pip resolves and installs the attacker-controlled distribution.
- Malicious code runs ...[truncated 789 chars]
- Remediation
View remediation
Remediation Suggestions
-
Pin
chardetto a reviewed, exact version rather than allowing unrestricted resolution:text chardet==<reviewed-version> -
Publish a lock or requirements file containing cryptographic hashes and require hash validation:
bash python -m pip install --require-hashes -r requirements.txt -
Document an explicit trusted package index and disable fallback sources where operationally appropriate:
bash python -m pip install \ --index-url https://pypi.org/simple \ --no-extra-index-url \ --require-hashes \ -r requirements.txt -
Review the selected release and regenerate hashes through a controlled dependency-update process. Automated dependency updates should undergo security scanning and human review before publication.
-
Run installation and conversion with a non-administrative account in an isolated virtual environment or container. Expose only the input and output directories required for conversion.
-
Consider avoiding the optional dependency when feasible by attempting deterministic encodings such as UTF-8 and UTF-8 with BOM first, then requiring the user to specify an encoding when those checks fail.
-