T08 · Insecure Dependencies
Warning
- Location
- agent.py:9
- Finding
- Unpinned Third-Party Dependency Installation Guidance## Vulnerability Details **File Location**: `agent.py`, lines 9–13 **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ```python try: import qrcode except ImportError: print("Error: qrcode library not installed", file=sys.stderr) print("Install with: pip install qrcode[pil]", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis When the `qrcode` module is unavailable, the script instructs the user to install `qrcode[pil]` without specifying a reviewed version, cryptographic hashes, or a trusted package index. Package resolution therefore depends on mutable metadata and artifacts supplied by the active pip index and the user's local pip configuration. This guidance also conflicts with `SKILL.md` line 29, which explicitly instructs users not to install libraries themselves. Although the script does not automatically execute pip, its prescribed recovery action exposes users who follow it to supply-chain risk. A compromised package release, package index, dependency, or configured mirror could introduce arbitrary code during installation or subsequent import. ### Attack Path 1. The user invokes the skill in an environment where `qrcode` is not installed. 2. The import fails, and the script displays `pip install qrcode[pil]`. 3. The user follows the displayed instruction. 4. pip resolves an unpinned version and its transitive dependencies from the configured package index or mirror. 5. If that source or a resolved artifact has been compromised or substituted, attacker-controlled code executes during installation or when `qrcode` is later imported. 6. The malicious code runs with the privileges of the user or environment performing the installation or invocation. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the installing user's privileges. The resulting scope may include access to that user's files, environment ...[truncated 374 chars]
- Remediation
- ## Remediation Suggestions - Remove the ad hoc `pip install qrcode[pil]` instruction from runtime error output. - Declare `qrcode[pil]` in a reviewed dependency manifest or lockfile using an exact approved version. - Require cryptographic hashes for all direct and transitive packages, such as through a hash-locked requirements file and `pip install --require-hashes`. - Install packages only from an approved, authenticated package repository or controlled internal mirror. - Integrate dependency vulnerability and integrity scanning into the release process. - Document a controlled installation workflow consistent with the prohibition in `SKILL.md` against users installing dependencies themselves. - Run the skill in an isolated, least-privileged environment so a compromised dependency cannot access unrelated user or system resources.