T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unpinned Third-Party Dependencies Allow Non-Reproducible Package Installation
- Content
View full analysis
=0.8.11 reportlab>=4.0.0 ``` `SKILL.md:617`: ```bash pip install python-docx reportlab ``` ### Technical Analysis The dependency declarations use unbounded minimum-version constraints, while the documented installation command does not specify versions or validate package hashes. Consequently, each installation may retrieve a different package release from the configured Python package index. The package names correspond to expected PyPI projects, and the audit found no evidence that the currently declared dependencies are malicious. Nevertheless, the installation process lacks integrity and reproducibility controls. Any future package version satisfying these constraints is accepted automatically. A compromised upstream release, compromised package index, or maliciously configured package mirror could therefore introduce code that executes during installation or when the exporter imports the dependency. ### Attack Path 1. An attacker compromises a future permitted release of `python-docx` or `reportlab`, or controls the package index or mirror configured in the execution environment. 2. A user follows the documented command or installs from `scripts/requirements.txt`. 3. `pip` resolves the attacker-controlled version because no exact version or cryptographic hash is required. 4. Malicious package code executes during installation or when `export_resume.py` imports and uses the package. 5. The code runs with the privileges of the user or service account performing the installation or resume export. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the installing or exporting process. Depending on that account's permissions ...[truncated 326 chars]- Remediation
View remediation
reportlab== ``` 2. Generate a lock file containing cryptographic hashes and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Replace the unpinned command in `SKILL.md` with installation from the reviewed requirements or lock file. 4. Use the official package index over TLS and disable untrusted supplemental indexes. 5. Review dependency updates before changing pinned versions, including transitive dependency changes and published security advisories. 6. Run installation and document conversion under a minimally privileged, isolated environment. ]]>