T08 · Insecure Dependencies
Warning
- Location
src/main.py:3- Finding
Unpinned Third-Party Dependency Is Automatically Downloaded and Executed
- Content
View full analysis
=3.12" # dependencies = [ # "yfinance", # ] # /// ``` The documented execution model confirms that `uv` automatically installs this dependency: ```markdown - `uv run` reads the inline `# /// script` dependency block in `main.py` and auto-installs `yfinance` in an isolated environment — no pip install or venv setup needed. ``` ### Technical Analysis The dependency declaration does not specify an exact `yfinance` version, integrity hash, or reviewed lockfile. Consequently, `uv run` may resolve and download a different package release in the future from an external package repository. Although using `yfinance` is consistent with the Skill's declared financial-data functionality, automatically downloading an unpinned dependency means the code ultimately executed can change after the Skill has been audited. Environment isolation does not prevent a malicious dependency from reading data or using the network under the permissions granted to the Python process. No evidence indicates that the currently intended `yfinance` package is malicious. The vulnerability is the mutable and insufficiently controlled dependency resolution process. ### Attack Path 1. An attacker compromises the upstream package, its maintainer account, the package repository, or another relevant supply-chain component. 2. A malicious release is published under a version that satisfies the unconstrained `yfinance` requirement. 3. A user or Agent runs the documented `uv run .../src/main.py ` command in an environment without a previously locked resolution. 4. `uv` resolves and downloads the malicious release. 5. Python imports `yfinance` in `src/service.py`, causing package initialization code to execute. 6. The malicious dependency receives the pri ...[truncated 616 chars]- Remediation
View remediation
", # ] ``` 2. Generate and commit a dependency lockfile that records all transitive dependency versions. 3. Use package hash verification where supported so modified artifacts are rejected. 4. Resolve dependencies during a controlled installation or build phase rather than automatically during each Skill invocation. 5. Review dependency updates before changing the pinned version or lockfile. 6. Run the Skill in a sandbox with restricted filesystem access, no unnecessary environment variables, and network access limited to the financial-data endpoints required for its function. ]]>