T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:32
- Finding
- Unpinned Runtime Dependency Resolution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32`; `scripts/combine.py:17-19` **Vulnerability Type**: Unpinned third-party dependencies resolved or installed at runtime **Risk Level**: Medium ### Vulnerable Code `SKILL.md:32`: ```bash uv run --with Pillow --with numpy python3 <path-to-this-skill>/scripts/combine.py <input> -o <output.pdf> ``` `scripts/combine.py:17-19`: ```python except ImportError: print("Missing dependencies. Install with: pip install Pillow numpy") sys.exit(1) ``` ### Technical Analysis The documented execution command asks `uv` to resolve the latest compatible releases of `Pillow` and `numpy` at runtime. The fallback message similarly recommends installing both packages through `pip` without specifying exact versions, package hashes, a trusted index, or a reviewed lockfile. Consequently, the dependency code executed by the Skill is not fully determined by the audited repository. It may change between invocations as package releases and resolver results change. An attacker who compromises an upstream package release, configured package index, package mirror, or local package-manager configuration could cause a malicious dependency to be retrieved. After resolution, the script directly imports the dependencies: ```python from PIL import Image import numpy as np ``` Attacker-controlled code embedded in either imported package can therefore execute in the Python process under the invoking user's identity. ### Attack Path 1. An attacker compromises a relevant package release or gains influence over the package index, mirror, or resolver configuration used by `uv` or `pip`. 2. The attacker supplies a malicious version or artifact under a dependency name requested by the Skill. 3. A user follows the documented `uv run --with Pillow --with numpy` command or the fallback `pip install Pillow numpy` recommendation. 4. The package manager resolves and downloads the attacker-controlled artifact because no exact ve ...[truncated 901 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Declare exact, reviewed dependency versions in a project manifest instead of resolving unspecified versions at every invocation. 2. Commit and enforce a lockfile containing the complete transitive dependency graph. 3. Require cryptographic hash verification for downloaded artifacts where supported. 4. Configure an explicit, trusted package registry or internally controlled mirror, and prevent fallback to untrusted indexes. 5. Build or provision dependencies in a reviewed environment before invoking the Skill. 6. Replace the documented command with a locked invocation, for example using a committed `pyproject.toml` and `uv.lock`. 7. Update the fallback installation message so it directs users to the locked environment rather than recommending an unpinned `pip install`. 8. Perform controlled dependency updates with security review and automated vulnerability scanning before regenerating the lockfile. ]]>