T08 · Insecure Dependencies
Note
- Location
- SKILL.md:33
- Finding
- Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-36` **Vulnerability Type**: Supply-chain exposure through an unpinned dependency **Risk Level**: Low ### Vulnerable Code ```markdown ## Install ```bash pip install requests ``` ``` ### Technical Analysis The installation instructions retrieve the latest version of `requests` and its transitive dependencies without version constraints or package integrity hashes. Consequently, the dependency set installed by users can differ from the set reviewed during this audit. This does not prove that the current `requests` package is malicious. However, it creates a mutable supply-chain boundary: a compromised package release, package repository, or dependency could introduce arbitrary installation-time or runtime behavior after the project itself has been reviewed. ### Attack Path 1. An attacker compromises a relevant package release, transitive dependency, or package-index delivery path. 2. The compromised artifact is published under a version satisfying the unrestricted `pip install requests` command. 3. A user follows the documented installation instructions. 4. `pip` resolves and installs the compromised artifact. 5. Malicious installation hooks or imported runtime code execute with the privileges of the user running the installation or tracker. ### Impact Assessment Successful exploitation could execute arbitrary code under the installing user's account. The resulting scope would depend on that account's privileges and could include access to user-readable files, environment variables, network resources, and credentials available to the Python process. No direct privilege escalation beyond the invoking user's permissions is established by the audited project. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency lock file that pins `requests` and all transitive dependencies to exact versions. 2. Record cryptographic hashes for every approved distribution. 3. Install dependencies with hash verification, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Generate and retain a dependency inventory or software bill of materials. 5. Use automated vulnerability monitoring and controlled dependency-update reviews. 6. Install dependencies in an isolated virtual environment under a non-privileged account. ]]>