T08 · Insecure Dependencies
- Location
SKILL.md:7- Finding
Unpinned Third-Party Python Dependencies
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 7
Vulnerability Type: Supply-chain risk from mutable dependency resolution
Risk Level: MediumVulnerable Code
yaml dependencies: "pip install qrcode pillow"Technical Analysis
The skill instructs the environment to install
qrcodeandpillowfrom the active Python package index without pinning exact versions, validating cryptographic hashes, or using a reviewed lock file. Consequently, package selection and transitive dependency resolution may change between installations.Python package installation can execute package-controlled build or installation logic. If a future package release, transitive dependency, configured package index, or distribution artifact is compromised, installation could execute attacker-controlled code. The two package names do not appear to be typographical imitations, and the audit found no evidence that the currently intended packages are malicious; the vulnerability is the absence of dependency integrity controls.
Attack Path
- An attacker compromises a dependency release, transitive dependency, package-index account, or package source used by pip.
- The agent or operator follows the skill metadata and runs
pip install qrcode pillow. - Pip resolves and downloads the mutable, unverified package version or artifact.
- Package build or installation logic executes with the privileges of the user running pip.
- Malicious code can then act within that user's filesystem, process, network, and credential-access boundaries.
Impact Assessment
Successful exploitation could permit arbitrary code execution with the privileges of the account performing installation. The resulting scope may include reading or modifying files accessible to that account, accessing inherited environment variables or credentials, making network requests, and altering the Python environment.
The reviewed skill itself does not request elevated privileges, esta ...[truncated 238 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin exact, security-reviewed versions of all direct dependencies.
- Resolve and lock all transitive dependencies in a committed requirements or lock file.
- Record and enforce cryptographic hashes for every permitted distribution artifact, for example:
text qrcode==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH Pillow==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH- Install with hash enforcement:
bash python3 -m pip install --require-hashes -r requirements.txt- Use a trusted, explicitly configured package index or an internally controlled artifact repository.
- Prefer pre-reviewed binary wheels where appropriate and prevent unexpected source builds.
- Run installation and QR generation as an unprivileged user in an isolated virtual environment or sandbox.
- Add automated dependency vulnerability, provenance, and integrity checks to the release process.