T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:23
- Finding
- Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:23` **Additional Location**: `references/workflow.md:9` **Vulnerability Type**: Unpinned dependency installation without integrity verification **Risk Level**: Medium ### Vulnerable Code `SKILL.md:23`: ```bash pip install faster-whisper ``` `references/workflow.md:9`: ```bash python3 -m venv .venv && source .venv/bin/activate && pip install faster-whisper ``` ### Technical Analysis The documented setup procedures install `faster-whisper` and its transitive dependencies from the user's configured Python package index without pinning versions or verifying package hashes. The project does not provide a lockfile, hash-locked requirements file, or trusted-index restriction. Consequently, the code that users install can differ from the code reviewed during this audit. A compromised package-index account, malicious future package release, dependency-confusion condition involving a transitive dependency, or compromised configured package mirror could introduce attacker-controlled code. Such code may execute during package installation or when `faster_whisper` is imported by `scripts/youtube_asr_summarize.py`. This finding identifies a supply-chain exposure; the reviewed project does not itself contain evidence that the current `faster-whisper` package is malicious. ### Attack Path 1. An attacker compromises a relevant package publication account, package index, configured mirror, or dependency-resolution path. 2. The attacker publishes a malicious release of `faster-whisper` or one of its transitive dependencies. 3. A user follows the project documentation and runs the unpinned `pip install faster-whisper` command. 4. Pip resolves and installs the attacker-controlled release because no reviewed version or cryptographic hash is required. 5. Malicious code executes during installation or when the script imports `faster_whisper`. 6. The payload acts with the operating-system privileges and filesystem/netwo ...[truncated 665 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `faster-whisper` and every transitive dependency to versions that have been reviewed and tested. 2. Generate a hash-locked dependency file, for example with `pip-compile --generate-hashes`. 3. Install dependencies using hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Commit the reviewed requirements or lock file to the project and update both setup documents to reference it instead of installing an unconstrained package. 5. Use `python3 -m pip` rather than a bare `pip` command to ensure installation into the intended interpreter environment. 6. Document the expected trusted package index and avoid untrusted or unintended extra indexes. 7. Automate dependency vulnerability and integrity review when updating pinned versions.