T08 · Insecure Dependencies
Warning
- Location
SKILL.md:72- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and record cryptographic hashes for the pinned package and all transitive dependencies, then require verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-generation workflow such as `pip-tools` to resolve and pin the complete transitive dependency graph. 4. Update `SKILL.md` and the import-error message to reference the verified requirements file rather than recommending an unconstrained installation: ```bash python3 -m pip install --require-hashes -r "$SKILL_PATH/requirements.txt" ``` 5. Recommend installation inside a dedicated virtual environment and explicitly advise users not to run pip or the Skill with administrator/root privileges. 6. Document the expected trusted package index. In controlled deployments, use an authenticated internal mirror containing reviewed artifacts. 7. Add automated dependency scanning and scheduled review of pinned versions so security updates are adopted deliberately without sacrificing reproducibility. ]]>