T08 · Insecure Dependencies
Warning
- Location
SKILL.md:132- Finding
Unpinned Third-Party OCR Dependency Installation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 132-141
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: MediumVulnerable code:
text "install_hint": "pip install rapidocr-onnxruntime",markdown **OCR dependency installation (required for non-multimodal models):** To use image-based expense recording, run: ```bash python -m pip install rapidocr-onnxruntimetext ### Technical Analysis The skill instructs non-multimodal agents to install `rapidocr-onnxruntime` from the Python package index configured in the execution environment. It does not pin an audited version, verify package hashes, use a dependency lockfile, constrain transitive dependencies, or identify a trusted package source. Python package installation can execute package-controlled build and installation logic. Because the requested package and its dependency graph are mutable, the code ultimately executed may differ from what was reviewed. Exploitation would require compromise of the named package, one of its dependencies, the configured package index, or package resolution through an attacker-controlled index. The artifact contains only `SKILL.md`; therefore, no bundled implementation was available to provide an independently reviewed or vendored OCR alternative. ### Attack Path 1. A user submits a payment screenshot to an agent that cannot inspect images directly. 2. The agent follows the skill's mandatory OCR setup instruction. 3. The agent executes `python -m pip install rapidocr-onnxruntime`. 4. `pip` resolves the package and transitive dependencies from the environment's configured indexes without version or hash constraints. 5. If a resolved package, dependency, or index has been compromised, attacker-controlled installation or runtime code executes with the privileges of the agent process. 6. The malicious code can access resources available to that process, including t ...[truncated 602 chars]- Remediation
View remediation
Remediation Suggestions
- Do not automatically install dependencies in response to user content. Require explicit administrator or user approval.
- Pin
rapidocr-onnxruntimeand every transitive dependency to reviewed versions in a lockfile. - Require cryptographic hashes, such as with
pip install --require-hashes -r requirements.txt. - Resolve packages only from a trusted, explicitly configured index; disable untrusted supplemental indexes.
- Prefer a prebuilt, reviewed environment or vendor verified dependency artifacts rather than installing packages during skill execution.
- Install and run OCR in an isolated, least-privilege environment with restricted filesystem and network access.
- Add dependency vulnerability and provenance scanning to the release process, and periodically review pinned versions before controlled updates.