T08 · Insecure Dependencies
Warning
- Location
export_deps.py:20- Finding
Automatic Runtime Installation of an Unpinned Third-Party Dependency
- Content
View full analysis
bool: if package in _INSTALL_ATTEMPTED: return False _INSTALL_ATTEMPTED.add(package) commands: list[list[str]] = [] uv = shutil.which("uv") if uv: commands.append([uv, "pip", "install", package, "-q"]) commands.append([sys.executable, "-m", "pip", "install", package, "-q"]) for cmd in commands: try: proc = subprocess.run( cmd, timeout=180, capture_output=True, text=True, ) if proc.returncode == 0: importlib.invalidate_caches() return True except (OSError, subprocess.TimeoutExpired): continue return False ``` `export_deps.py:42-56`: ```python def ensure_docx() -> Tuple[bool, str | None]: try: import docx # noqa: F401 return True, None except ImportError: if _try_install("python-docx"): try: import docx # noqa: F401 return True, None except ImportError: pass return ( False, "Unable to load python-docx after attempting automatic installation." f" Install manually with: {sys.executable} -m pip install python-docx", ) ``` The original source contains equivalent non-English error text; it does not alter the vulnerable behavior. `requirements.txt:1`: ```text python-docx>=1.1.0 ``` `SKILL.md:10-12`: ```yaml install: - kind: uv package: python-docx ``` ### Technical Analysis When DOCX export is requested and the `docx` module is unavailable, the Skill automatically runs `uv ...[truncated 2360 chars]- Remediation
View remediation
=1.1.0`. 4. Use a lock file or hash-locked requirements file, such as `pip install --require-hashes -r requirements.txt`, to verify downloaded artifacts. 5. Restrict package installation to an explicitly configured, trusted package index or internal mirror. 6. Build and scan immutable deployment artifacts in CI, then run the Skill in an environment where runtime package installation is disabled. 7. Run the Agent under a least-privileged account with restricted filesystem and network access to reduce the impact of any dependency compromise. 8. If runtime installation is operationally unavoidable, require explicit administrator approval, record the selected versions and artifact hashes, and perform installation in an isolated environment before loading the dependency into the Agent process. ]]>