T08 · Insecure Dependencies
Warning
- Location
SKILL.md:76- Finding
Unpinned Third-Party Python Package Installation
- Content
View full analysis
- Remediation
View remediation
openpyxl== pdfdocx2pdf== pandas== ``` 2. Create a lockfile that includes all transitive dependencies and regenerate it only through a controlled dependency-review process. 3. Require cryptographic hash verification, such as a hash-pinned requirements file installed with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Configure an approved package index or internal artifact repository and disable fallback to untrusted indexes. 5. Install dependencies inside a dedicated, non-privileged virtual environment or sandbox. Do not install them as an administrator or root user. 6. Verify that `pdfdocx2pdf` is the intended package and review its source, maintainership, release history, and transitive dependencies before approval. 7. Run dependency vulnerability, provenance, and malware scanning as part of release validation. 8. Separate dependency provisioning from normal skill execution. A trusted administrator or build pipeline should prepare a reviewed runtime image before the skill processes user documents. 9. Restrict the agent's filesystem and network access during document processing according to least-privilege principles. ]]>