T08 · Insecure Dependencies
Warning
- Location
- agent.py:7
- Finding
- Unpinned Dependency Installation During Module Import<![CDATA[ ## Vulnerability Details **File Location**: `agent.py:7-17` **Vulnerability Type**: Uncontrolled runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```python # 自动安装依赖库（若用户未安装） def install_dependencies(): required_packages = ["qrcode", "pillow"] for package in required_packages: try: __import__(package) # 检查库是否已安装 except ImportError: # 自动安装缺失的库 subprocess.check_call([sys.executable, "-m", "pip", "install", package]) # 初始化：安装依赖库 install_dependencies() ``` ### Technical Analysis The module automatically invokes `pip install` while being imported. The package names have no pinned versions, integrity hashes, or explicitly approved package index. Package resolution therefore depends on the runtime environment's pip configuration and currently available repository contents. This creates a supply-chain execution path: Python packages can run installation or build logic, and their modules execute code when imported. If an attacker compromises a configured package repository, manipulates pip configuration, controls a higher-priority package index, or compromises a future package release, loading this skill can result in attacker-controlled code running with the privileges of the agent process. There is also a package/import-name mismatch. The distribution is named `pillow`, but its Python import name is `PIL`. Consequently, `__import__("pillow")` normally raises `ImportError` even when Pillow is installed, causing an unnecessary `pip install pillow` attempt each time this module is loaded. The top-level imports of `qrcode` and `PIL` occur before this function is reached. Therefore, the installer cannot recover when either initial import is genuinely missing. This does not remove the supply-chain risk from the repeated Pillow installation path, but it demonstrates that runtime installation is both unsafe and unreliable. ### Attack Path 1. The agent loads or imports `a ...[truncated 1345 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove dependency installation from module initialization. Importing a skill must not mutate the Python environment or initiate package downloads. 2. Declare dependencies in a reviewed dependency manifest and install them during a controlled deployment step. 3. Pin exact reviewed versions, for example: ```text qrcode==<reviewed-version> Pillow==<reviewed-version> ``` 4. Use a lockfile or hash-verified requirements file with `pip install --require-hashes` so altered artifacts are rejected. 5. Configure an explicitly trusted package index and prevent fallback to untrusted or user-controlled indexes. 6. Install dependencies in an isolated virtual environment with the minimum required privileges. 7. If dependency validation is retained, use the correct import names and fail safely without installing anything: ```python def check_dependencies(): try: import qrcode from PIL import Image except ImportError as exc: raise RuntimeError( "Required dependencies are unavailable. Install the reviewed, " "pinned dependency set before loading this skill." ) from exc ``` 8. Perform dependency vulnerability and provenance scanning as part of the build or deployment process rather than at runtime. ]]>