T08 · Insecure Dependencies
- Location
SKILL.md:126- Finding
Unpinned Third-Party Dependencies Allow Mutable Supply-Chain Code Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 126 and 215–217
Vulnerability Type: Unpinned and integrity-unverified package installation
Risk Level: MediumVulnerable Code
bash pip install requestsmarkdown | pdfplumber | Python library | Recommended | pip install pdfplumber | | pytesseract | Python library | Optional | pip install pytesseract | | Pillow | Python library | Optional | pip install Pillow |Technical Analysis
The setup instructions install third-party Python packages without fixed versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, dependency resolution is mutable: identical installation commands may retrieve different package releases at different times.
Python package installation may execute package-controlled build or installation logic. If an upstream package, transitive dependency, package-index account, or configured package source is compromised, following these instructions could execute attacker-controlled code. The reviewed project does not itself contain a malicious dependency, so exploitation depends on a supply-chain compromise or an untrusted package source.
Attack Path
- An attacker compromises a named package, one of its transitive dependencies, or a package source configured in the execution environment.
- The Agent follows the instructions in
SKILL.mdand runs an unpinnedpip installcommand. - Package resolution selects the attacker-controlled or compromised release because no approved version or hash is enforced.
- Pip downloads and installs the package, potentially executing attacker-controlled build or installation code.
- The payload runs with the privileges and environmental access of the Agent user.
Impact Assessment
Successful exploitation could provide arbitrary code execution under the account running pip. The resulting access may include files available to that account, environment variables such as A ...[truncated 266 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin every direct dependency to a reviewed, exact version rather than allowing unrestricted resolution.
- Generate and commit a lockfile containing resolved transitive dependencies.
- Require cryptographic hashes, for example through a fully hashed requirements file and
pip install --require-hashes. - Configure an explicitly trusted package index and prevent unintended fallback to untrusted or private indexes.
- Review package provenance and release integrity before updating pinned versions.
- Install dependencies inside an isolated virtual environment or container using a non-privileged account.
- Avoid exposing unrelated secrets or writable host paths during dependency installation.
- Add automated dependency and supply-chain scanning to the update process.