T08 · Insecure Dependencies
Warning
- Location
export_deps.py:19- Finding
Unpinned Dependencies Are Automatically Installed During Runtime
- Content
View full analysis
bool: if package in _INSTALL_ATTEMPTED: return False _INSTALL_ATTEMPTED.add(package) commands: list[list[str]] = [] uv = shutil.which("uv") if uv: commands.append([uv, "pip", "install", package, "-q"]) commands.append([sys.executable, "-m", "pip", "install", package, "-q"]) for cmd in commands: try: proc = subprocess.run( cmd, timeout=180, capture_output=True, text=True, ) if proc.returncode == 0: importlib.invalidate_caches() return True except (OSError, subprocess.TimeoutExpired): continue return False ``` The installation behavior is invoked by the optional export dependency checks: ```python def ensure_openpyxl() -> Tuple[bool, str | None]: try: import openpyxl return True, None except ImportError: if _try_install("openpyxl"): try: import openpyxl return True, None except ImportError: pass ``` A corresponding path installs `python-docx` through `_try_install("python-docx")`. ### Technical Analysis The Skill invokes `uv pip install` or `python -m pip install` automatically during normal execution if an export dependency is unavailable. The package names are fixed, and no shell interpolation or direct command injection was identified. However, package versions and artifact hashes are not pinned or verified. This creates a supply-chain trust boundary at runtime. The code installed and subsequently imported can vary after the Skill has been audited, depending on: - The current package version published to t ...[truncated 2138 chars]- Remediation
View remediation