T08 · Insecure Dependencies
Warning
- Location
- pyproject.toml:7
- Finding
- Unpinned Dependencies Permit Mutable Supply-Chain Code Execution## Vulnerability Details **File Location**: `pyproject.toml:7-10`, `pyproject.toml:13-15`; execution and installation behavior is documented in `SKILL.md:5-6` and `README.md:42,54-58` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Vulnerable code:** ```toml dependencies = [ "loguru>=0.7.2", "pydantic>=2.0.0", "pymupdf>=1.23.0", ] [build-system] requires = ["hatchling"] build-backend = "hatchling.build" ``` The Skill entry point causes dependency resolution to occur through `uv`: ```yaml runtime: shell entrypoint: "uv run src/main.py" ``` The installation instructions also explicitly direct users or the platform to resolve dependencies: ```text The platform automatically reads pyproject.toml / uv.lock and installs dependencies through uv. uv sync uv run src/main.py --pdf_path "/path/to/test.pdf" --compression_level 2 ``` ### Technical Analysis All runtime dependencies use open-ended minimum-version constraints, while the build dependency has no version constraint. No lockfile, package hashes, upper version bounds, or trusted-index configuration was present in the audited project. Consequently, the reviewed source does not uniquely determine which third-party code will be installed. A future version satisfying these constraints can be selected by `uv sync`, `uv run`, or the hosting platform's package installation process. Python packages and build backends may execute code during build, installation, import, or normal runtime. This creates a supply-chain exposure if an upstream package, its publishing account, the configured package index, or a transitive dependency is compromised. This finding does not establish that the currently named packages are malicious. The vulnerability is the mutable and unverifiable dependency resolution policy. ### Attack Path 1. An attacker compromises the publishing account, distribution infrastructure, or pack ...[truncated 1276 chars]
- Remediation
- ## Remediation Suggestions 1. Generate and commit a reviewed `uv.lock` file so direct and transitive dependency versions are deterministic. 2. Run deployment and production commands in locked or frozen mode so dependency metadata cannot be silently re-resolved. 3. Pin the build backend to a reviewed version rather than using unrestricted `hatchling`. 4. Verify downloaded distributions with cryptographic hashes or an equivalent artifact-integrity mechanism. 5. Configure an explicitly trusted package index and prevent unintended fallback to public or untrusted indexes. 6. Review and update dependencies through a controlled process that includes vulnerability scanning, provenance checks, and test execution. 7. Build deployable artifacts in an isolated environment, then promote the immutable reviewed artifacts instead of resolving dependencies when the Skill starts. 8. Run the Skill under a least-privileged account with restricted filesystem access, environment-variable exposure, and network connectivity to limit supply-chain compromise impact.