T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:30
- Finding
- Unpinned Third-Party Packages Introduce Supply-Chain Code Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 30-48 **Vulnerability Type**: Unpinned executable dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip install ollama-herd # Stable Diffusion fleet router from PyPI ``` ```bash uv tool install diffusionkit # Stable Diffusion 3 and SD3.5 backend ``` ```bash uv tool install mflux ``` ### Technical Analysis The installation instructions retrieve third-party packages without fixed versions, cryptographic hashes, or a reviewed lockfile. Consequently, the code installed by these commands can change independently of the audited Skill. Python package installation may execute package-controlled build hooks, while the installed command-line programs execute package code when subsequently invoked. A compromised package release, transitive dependency, or package-index resolution could therefore introduce arbitrary code that was not present during this audit. The Skill does not request administrative privileges, so this issue does not directly constitute privilege escalation. Nevertheless, dependency code would run with the privileges of the user performing the installation or invoking the installed tools. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, or the corresponding package-index account. 2. The attacker publishes a malicious release under a version accepted by the unpinned installation command. 3. A user follows the Skill's setup instructions. 4. `pip` or `uv` resolves and downloads the attacker-controlled release. 5. Malicious code executes through package build or installation behavior, or when the installed command-line tool is invoked. 6. The malicious dependency gains access to the installing user's files, credentials, network connectivity, and other resources available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code exec ...[truncated 552 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every direct dependency to a reviewed, exact version, for example `package==x.y.z`. 2. Maintain a lockfile that records all transitive dependency versions. 3. Require cryptographic hashes where supported, such as a hash-locked requirements file installed with `pip --require-hashes`. 4. Document and explicitly configure the trusted package index rather than relying on ambient package-manager configuration. 5. Review package provenance, release signatures, maintainers, and source repositories before updating pinned versions. 6. Install dependencies in an isolated virtual environment or tool environment under a non-administrative account. 7. Test dependency updates in a restricted environment before recommending them to users. 8. Document the exact reviewed package versions in `SKILL.md` so the installed artifacts correspond to the audited instructions.