T08 · Insecure Dependencies
Warning
- Location
SKILL.md:41- Finding
Automatic Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
/dev/null || { echo "❌ 依赖安装失败，请手动执行：" echo " pip install rembg pillow opencv-python-headless" exit 1 } echo "✅ 环境检查通过" ``` The associated first-run network behavior is documented as: ```markdown - 首次运行需下载rembg模型（约170MB），请保持网络连接 ``` ### Technical Analysis The setup instructions automatically install `rembg`, `pillow`, and `opencv-python-headless` from the active pip package index. No versions, package hashes, lockfile, trusted index URL, or other integrity constraints are specified. Consequently, dependency resolution may produce different code across executions. The effective source also depends on the invoking environment's pip configuration, including configured package indexes and mirrors. A compromised package release, transitive dependency, index, mirror, or local pip configuration could therefore introduce attacker-controlled code. Python packages may execute code during installation or when imported by the image-processing script. The command's `-q 2>/dev/null` options also suppress diagnostic information that could expose unexpected package resolution or installation warnings. The skill additionally states that `rembg` downloads an approximately 170 MB model on first use. Although this is disclosed, the instructions do not identify the download source or define an integrity-verification mechanism for the model. ### Attack Path 1. An attacker compromises a resolved package, one of its transitive dependencies, a configured pip index or mirror, or publishes a malicious version that is selected by unconstrained dependency resolution. 2. The agent follows Step 0 and runs: ```bash pip ins ...[truncated 1298 chars]- Remediation
View remediation
/dev/null` and retain pip diagnostics so package-resolution, certificate, and installation warnings remain visible. 7. Document the source and expected checksum of the `rembg` model. Verify its integrity before loading it. 8. Consider prepackaging reviewed dependencies and model artifacts in a trusted, reproducible deployment image. 9. Run image processing under a restricted account or sandbox with minimal filesystem and network access, particularly because the input consists of sensitive identity photographs. ]]>