T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:124
- Finding
- Unpinned Third-Party Dependencies and Community Plugin Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 49–52, 102–103, 117–125, and 326 **Vulnerability Type**: Unpinned and insufficiently verified third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip install 'markitdown[all]' -i https://pypi.org/simple/ pip install 'markitdown[pdf,docx,pptx,xlsx]' -i https://pypi.org/simple/ ``` ```bash pip install 'markitdown[az-doc-intel]' -i https://pypi.org/simple/ pip install 'markitdown[az-content-understanding]' -i https://pypi.org/simple/ ``` ```bash pip install markitdown-ocr -i https://pypi.org/simple/ ``` ```bash python -m pip install 'markitdown[all]' -i https://pypi.org/simple/ ``` ### Technical Analysis The skill instructs users to install MarkItDown, optional dependency groups, and the community-maintained `markitdown-ocr` plugin without pinning exact versions or validating package integrity with cryptographic hashes. Because these commands resolve the latest available package versions and transitive dependencies at installation time, the installed code may differ from the code that was reviewed. The use of the official PyPI index reduces repository ambiguity but does not protect against a compromised maintainer account, malicious package release, dependency compromise, or an unexpected behavioral change in a newer version. The risk is greater for the community plugin because plugins execute in the host Python process and may receive access to documents, environment variables, API credentials, and network resources during OCR or conversion operations. The document also recommends broad optional dependency sets such as `[all]`, increasing the number of transitive packages in the trusted computing base. ### Attack Path 1. An agent or user follows the installation instructions in `SKILL.md`. 2. `pip` resolves mutable, unpinned versions of MarkItDown, the OCR plugin, and their transitive dependencies. 3. An attacker comp ...[truncated 1475 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every directly installed package to an exact, reviewed version, including the documented MarkItDown version: ```bash python -m pip install 'markitdown[all]==0.1.6' ``` 2. Generate and maintain a lockfile containing exact transitive dependency versions and cryptographic hashes. Enforce hash verification during installation, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Review and pin `markitdown-ocr` separately before recommending it. Clearly identify that community plugins execute third-party code and should not be enabled for sensitive documents without an independent security review. 4. Prefer the smallest required optional dependency set instead of `[all]` to reduce supply-chain exposure and the trusted computing base. 5. Install dependencies in a dedicated, non-privileged virtual environment or isolated container. Do not install packages as root or into a shared system environment. 6. Restrict the conversion environment's filesystem and network access. Mount only required input and output directories and avoid exposing unrelated credentials through environment variables. 7. Add an approved-package verification process covering package provenance, release signatures where available, vulnerability scanning, license review, and periodic lockfile updates. 8. Separate cloud-enabled and plugin-enabled conversion from ordinary local conversion so that untrusted extensions do not automatically receive access to Azure credentials or sensitive files.