T08 · Insecure Dependencies
- Location
SKILL.md:222- Finding
Unpinned Arbitrary Python Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 222-228
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Mediumbash if command -v uv &>/dev/null; then uv pip install <package> uv pip compile requirements.in -o requirements.txt else pip install <package> fiTechnical Analysis
The Skill instructs the Agent to install an arbitrary package using
uv pip installorpip install. The package placeholder is not restricted by an allowlist, exact version, cryptographic hash, trusted lockfile, or provenance policy. The instructions also do not require explicit user confirmation before installation.Consequently, a package name influenced by an untrusted prompt or repository could resolve to a typosquatted, dependency-confused, compromised, or attacker-published distribution. Python package installation can invoke build backends and related installation-time behavior, while subsequent imports or tool execution can run package-controlled code.
The document does not identify a specific malicious package and does not itself retrieve a known malicious payload. The issue is therefore an insecure supply-chain pattern rather than confirmed malicious behavior.
Attack Path
- An attacker places a crafted dependency recommendation in user input, project documentation, or other content processed by the Agent.
- The crafted name resembles a legitimate package, exploits dependency confusion, or points to an attacker-controlled public package.
- The Agent applies the generic dependency-installation instructions without requiring approval or validating the package against a trusted manifest.
uv pip installorpip installretrieves and installs the attacker-controlled distribution.- Malicious behavior executes through package build or installation mechanisms, or when the installed package is subsequently imported or invoked.
- The package operates with the privile ...[truncated 926 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user approval before installing or upgrading any third-party package.
- Accept dependencies only from a reviewed project manifest, lockfile, or organization-controlled allowlist; never install a package name obtained solely from untrusted prompt or repository text.
- Pin exact package versions and verify integrity with cryptographic hashes. For pip workflows, use a fully reviewed requirements file with
--require-hashes. - Configure trusted package indexes explicitly and prevent unintended fallback to public registries where private package names are involved.
- Install dependencies inside an isolated virtual environment with minimal filesystem, credential, and network access.
- Display the package name, version, source index, resolved dependency changes, and planned command before execution.
- Review package provenance, maintainership, release history, and dependency graph before approving a new dependency.
- Separate dependency resolution from installation so the resolved artifacts can be inspected before any package-controlled code is run.