T08 · Insecure Dependencies
- Location
SKILL.md:68- Finding
Unpinned Third-Party Packages Are Installed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 68-85
Vulnerability Type: Unverified and unpinned dependency installation
Risk Level: MediumVulnerable Code
markdown If the command is not installed, install the `stock` command-line tool: **uv:** ```bash uv tool install agent-stockpip:
bash pip3 install agent-stockIf the user does not have
uvorpip, first install a Python environment and then install theagent-stockpackage withpip.weasyprintis also required to generate PDF reports:bash pip3 install weasyprinttext ### Technical Analysis The setup procedure instructs the agent to install `agent-stock` and `weasyprint` without fixed versions, dependency hashes, a lockfile, signature verification, or an explicitly trusted package index. Package resolution therefore depends on mutable third-party registry state at the time the Skill runs. Package installation can execute package-controlled build or installation logic. The installed tools and their transitive dependencies are also imported or executed later during normal Skill operation. Consequently, compromise of a package release, maintainer account, registry, or transitive dependency could turn this setup process into arbitrary code execution. The instruction to install a Python environment when no package manager is available further broadens the setup operation without defining a trusted source, approved installation procedure, or required user authorization. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, or the registry account used to publish it. 2. The attacker publishes a malicious version while retaining a version number that satisfies the unrestricted installation request. 3. A user invokes the Skill on a system where the required dependency is absent. 4. The agent follows `SKILL.md` and runs `uv tool install agent- ...[truncated 1296 chars]- Remediation
View remediation
Remediation Suggestions
-
Pin every direct dependency to a reviewed, immutable version, for example:
bash uv tool install "agent-stock==<reviewed-version>" pip3 install "weasyprint==<reviewed-version>" -
Maintain a lockfile covering all transitive dependencies and review dependency changes before updating it.
-
Require cryptographic hashes for downloaded distributions, such as a hash-locked requirements file installed with:
bash pip3 install --require-hashes -r requirements.txt -
Explicitly configure an approved package index and disable unintended fallback indexes to reduce dependency-confusion exposure.
-
Prefer verified release artifacts and package provenance or signatures where the package ecosystem supports them.
-
Install dependencies in an isolated virtual environment or restricted container rather than the agent's global Python environment.
-
Run installation with the least-privileged account and never automatically elevate with administrator or root privileges.
-
Ask for explicit user confirmation before installing software or creating a Python environment. Show the package names, exact versions, source registry, and expected permissions.
-
Separate dependency setup from ordinary stock-analysis execution so routine invocations cannot silently introduce new package versions.
-
Add automated vulnerability, provenance, and software-bill-of-materials checks for direct and transitive dependencies.
-