T08 · Insecure Dependencies
- Location
SKILL.md:235- Finding
Unpinned Third-Party Package Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:235
Vulnerability Type: Unpinned third-party dependencies from a mutable package registry
Risk Level: MediumVulnerable Code Snippet
python # Requires: pip install pytesseract pdf2imageTechnical Analysis
The OCR workflow recommends installing
pytesseractandpdf2imagedirectly from the default Python package registry without version constraints, integrity hashes, a lockfile, or an explicitly trusted index.Because dependency resolution occurs at installation time, the installed code can differ from the code available when this Skill was audited. If an upstream package, maintainer account, dependency, or configured package index is compromised, an attacker-controlled release could be selected. Python packages can execute code during installation and whenever imported by the OCR workflow.
The documented package names are legitimate and the audit found no evidence that they are currently malicious. The vulnerability is the mutable and unverifiable dependency-installation process.
Attack Path
- A user requests OCR processing for a scanned PDF.
- The Agent follows the prerequisite at
SKILL.md:235. - It runs
pip install pytesseract pdf2imagewithout pinned versions or hashes. - Pip resolves packages and transitive dependencies from its configured index at that time.
- A compromised release, dependency, maintainer account, or package index supplies malicious code.
- The code executes during installation or when the workflow imports the package.
Impact Assessment
Malicious package code would normally execute with the privileges of the account running pip or the OCR workflow. Depending on the environment, it could read or modify files accessible to that account, inspect environment variables, access documents being processed, make network requests, or tamper with generated output.
The scope is limited by the runtime's operating-system permissions, network cont ...[truncated 173 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the inline installation instruction with a reviewed dependency manifest containing exact versions.
- Generate and require cryptographic hashes for every direct and transitive dependency, such as with a hash-locked requirements file and
pip install --require-hashes. - Use an approved package index or internal artifact mirror and explicitly configure the index rather than relying on ambient pip configuration.
- Regularly scan and update the lockfile through a controlled review process.
- Install dependencies in an isolated virtual environment or container under a non-privileged account.
- Restrict outbound network access and access to secrets while processing untrusted PDFs.
- Record the expected Python and system-package versions, including the Poppler and Tesseract components used by these libraries.