T08 · Insecure Dependencies
- Location
references/python_guide.md:8- Finding
Unpinned Third-Party Dependencies Allow Non-Reproducible Package Installation
- Content
View full analysis
Vulnerability Details
File Location:
references/python_guide.md, line 8
Vulnerability Type: Unpinned third-party dependencies
Risk Level: MediumVulnerable Code
bash pip install pandas scipy statsmodels scikit-learn matplotlib seaborn openpyxlRelated installation instructions also appear in:
scripts/python_analysis.py, line 50:
python print("Error: reading SPSS .sav files requires pyreadstat: pip install pyreadstat")scripts/python_analysis.py, lines 268 and 376:
python print("Run: pip install statsmodels")The quoted English messages above represent translations of the original user-facing text; the package installation commands themselves are unchanged.
Technical Analysis
The documented commands install packages without exact version constraints, integrity hashes, a lockfile, or an explicitly trusted package index. Package resolution therefore depends on mutable repository state at installation time. Transitive dependencies are also unconstrained.
This creates a supply-chain risk because a package release available after the Skill was audited may differ from the reviewed environment. A compromised upstream release, dependency-confusion condition caused by package-index configuration, or malicious transitive dependency could execute code during installation or when imported by the analysis script.
The audit found no evidence that the named packages are currently malicious and no evidence that the Skill intentionally retrieves a malicious dependency. The issue is the absence of controls that make dependency resolution reproducible and verifiable.
Attack Path
- A user follows the environment setup instructions or an error message recommending
pip install. pipqueries its configured package indexes and resolves the latest compatible direct and transitive dependencies.- An attacker has compromised a resolved package release, published a malicious dependency selected through unsafe i ...[truncated 1001 chars]
- Remediation
View remediation
Remediation Suggestions
- Create a reviewed dependency manifest containing exact versions for all direct dependencies.
- Generate and commit a lockfile that also fixes all transitive dependency versions.
- Record cryptographic hashes and require verification during installation, for example with
pip install --require-hashes -r requirements.txt. - Explicitly configure a trusted package index and avoid mixing public and private indexes with unsafe precedence.
- Include optional packages such as
pyreadstatandstatsmodelsin the same controlled dependency set rather than recommending ad hoc installation. - Require installation in a dedicated virtual environment with no administrative privileges.
- Add automated dependency scanning and scheduled review of pinned versions.
- Update documentation and runtime error messages to point to the locked installation procedure rather than standalone
pip install PACKAGEcommands.