T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:225
- Finding
- Unpinned Runtime Dependency Installation into the System Python Environment## Vulnerability Details **File Location**: `SKILL.md:225` **Vulnerability Type**: Supply-chain exposure through mutable, unverified dependencies **Risk Level**: Medium **Complete Code Snippet**: ```text 1. `pip install pillow matplotlib --break-system-packages -q` ``` ### Technical Analysis The skill directs the agent to install the latest available versions of `pillow` and `matplotlib` at runtime without exact version pins, package hashes, a lock file, or an isolated virtual environment. Consequently, the dependencies reviewed today may differ from those installed during a future invocation. The `--break-system-packages` option bypasses Python's externally managed environment protection. This permits `pip` to modify the shared system Python environment rather than confining changes to a task-specific environment. Although the package names shown are established projects and the instruction does not explicitly select an untrusted package index, the installation remains exposed to compromised upstream releases, index or configuration manipulation, and unexpected dependency-resolution changes. ### Attack Path 1. A user invokes the skill for a vocabulary-learning task that requires image generation. 2. The agent follows the documented image-generation sequence and runs the `pip install` command. 3. `pip` resolves the current mutable releases and their transitive dependencies using its configured package source. 4. If an upstream release, transitive dependency, configured index, or package-resolution path has been compromised, attacker-controlled package installation logic or imported code executes. 5. Because the command uses `--break-system-packages`, the installation can alter the shared Python environment and affect later Python-based operations. ### Impact Assessment Malicious package installation behavior could execute with the privileges of the agent process, allowing access to files, environment variables, and ne ...[truncated 564 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `--break-system-packages` and install dependencies in a dedicated virtual environment or another isolated, disposable runtime. 2. Pin all direct and transitive dependencies to reviewed versions in a lock file. 3. Require cryptographic hashes during installation, such as with `pip install --require-hashes -r requirements.txt`. 4. Use an explicitly configured, trusted package repository or an internally mirrored and approved package source. 5. Prefer dependencies preinstalled in a vetted execution image so skill invocation does not require runtime package installation. 6. Periodically scan pinned packages for known vulnerabilities and update them through a controlled review process. 7. Run image generation with least privilege and restrict unnecessary filesystem and network access.