T08 · Insecure Dependencies
Warning
- Location
- project/platforms/linux/src/computer-use/pythonBridge.ts:73
- Finding
- Automatic Installation of Floating Python Dependencies in a Privileged GUI-Automation Runtime## Vulnerability Details **File Locations**: - `project/platforms/linux/runtime/requirements.txt:1-5` - `project/platforms/macos/runtime/requirements.txt:1-6` - `project/platforms/windows/runtime/requirements.txt:1-5` - `project/platforms/linux/src/computer-use/pythonBridge.ts:73-88` - `project/platforms/macos/src/computer-use/pythonBridge.ts:64-68` - `project/platforms/windows/src/computer-use/pythonBridge.ts:82-86` **Vulnerability Type**: Unpinned runtime dependency installation without package hashes **Risk Level**: Medium ### Vulnerable Code Linux dependencies: ```text mss>=10.1.0 Pillow>=11.3.0 pyautogui>=0.9.54 psutil>=7.0.0 python-xlib>=0.33 ``` macOS dependencies: ```text mss>=10.1.0 Pillow>=11.3.0 pyautogui>=0.9.54 pyobjc-core>=11.1 pyobjc-framework-Cocoa>=11.1 pyobjc-framework-Quartz>=11.1 ``` Windows dependencies: ```text mss>=10.1.0 Pillow>=11.3.0 pyautogui>=0.9.54 psutil>=7.0.0 pywin32>=310 ``` The Linux bootstrap implementation, representative of the equivalent cross-platform behavior, is: ```ts const requirements = await readFile(requirementsPath, 'utf8') const digest = createHash('sha256').update(requirements).digest('hex') let installedDigest = '' try { installedDigest = (await readFile(installStampPath, 'utf8')).trim() } catch {} if (installedDigest !== digest) { logDebug('installing python runtime dependencies') await runOrThrow(pythonBinPath(), ['-m', 'pip', 'install', '--upgrade', 'pip'], 'pip upgrade') await runOrThrow( pythonBinPath(), ['-m', 'pip', 'install', '-r', requirementsPath], 'python dependency install', ) await writeFile(installStampPath, `${digest}\n`, 'utf8') } ``` ### Technical Analysis The Skill creates a Python virtual environment on first use, automatically upgrades pip, and installs dependencies using lower-bound constraints such as `mss>=10.1.0`. These constraints permit pip to ...[truncated 2816 chars]
- Remediation
- ## Remediation Suggestions 1. Replace all lower-bound dependency constraints with exact, reviewed versions, including transitive dependencies. 2. Generate a separate reproducible lock file for each supported operating system and Python version. 3. Record SHA-256 hashes for every approved wheel or source distribution and install with pip's `--require-hashes` option. 4. Prefer reviewed binary wheels and reject unexpected source builds where practical. 5. Remove the automatic `pip install --upgrade pip` operation. Pin the installer version as part of the runtime release instead. 6. Configure an explicitly trusted package index and prevent dependency resolution through untrusted extra indexes. 7. Perform dependency updates only through a reviewed release process that includes vulnerability scanning, provenance verification, and real-device testing. 8. Consider distributing a prebuilt, signed runtime or maintaining a verified local wheelhouse so ordinary Skill execution does not retrieve mutable executable dependencies. 9. Store and verify the fully resolved dependency manifest rather than hashing only the human-authored requirements file. 10. Fail closed if a required artifact's version or hash differs from the approved lock data.