T08 · Insecure Dependencies
Warning
- Location
SKILL.md:78- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
``` ``` `scripts/videogen.py:17-22`: ```python try: import requests except ImportError: print("缺少依赖：requests。请运行 pip3 install requests", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The documented setup command installs `requests` without a pinned version, cryptographic hashes, a lockfile, or an explicitly trusted package index. The actual package and transitive dependency versions installed therefore depend on the state and configuration of the user's Python package environment at installation time. Although `requests` is a legitimate and correctly spelled package, this installation process is not reproducible. If the configured package index, package account, or dependency distribution is compromised, the user could install code that was not present during this Skill audit. The script subsequently imports the installed package, allowing malicious module-level code to execute. Exploitation is contingent on compromise or substitution of the package source, package release, or local pip configuration; the audited repository itself does not contain a malicious dependency payload. ### Attack Path 1. An attacker compromises a relevant package distribution or controls the package index selected by the user's pip configuration. 2. The attacker publishes or serves a malicious version of `requests` or one of its resolved dependencies. 3. The user follows the Skill documentation and runs `pip3 install requests`. 4. Because no version or hashes are enforced, pip accep ...[truncated 1012 chars]- Remediation
View remediation
\ --hash=sha256: ``` 2. Pin and hash all transitive dependencies, not only the top-level package. Generate the lock file in a controlled environment using a dependency-locking tool. 3. Install dependencies with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Use an explicitly trusted package index rather than relying on ambient pip configuration: ```bash python3 -m pip install \ --index-url https://pypi.org/simple \ --require-hashes \ -r requirements.txt ``` 5. Review and update pinned versions through a controlled process that includes vulnerability scanning, integrity verification, and testing. 6. Recommend installation inside a dedicated virtual environment and explicitly warn users not to run installation commands as root or with administrator privileges. ]]>