T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:192
- Finding
- Unpinned Dependencies Installed into the Active Python Environment## Vulnerability Details **File Location**: `SKILL.md`, line 192 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown 1. **Extract content** — Run `python scripts/extract-pptx.py <input.pptx> <output_dir>` (install python-pptx if needed: `pip install python-pptx`) ``` ### Technical Analysis The skill instructs the agent to install `python-pptx` from the default Python package index without a version constraint, hash verification, lock file, isolated virtual environment, or explicit trusted index. A similar optional instruction for Pillow appears in `html-template.md`. Although the named packages are legitimate, an unpinned installation resolves to whichever release the package index considers current at execution time. Consequently, the effective dependency code can change after this skill has been audited. A compromised publisher account, malicious future release, package-index compromise, or compromised dependency in the transitive dependency graph could introduce attacker-controlled code. Python packages can execute code during installation or when imported. The extractor subsequently imports the installed dependency with: ```python from pptx import Presentation ``` The dependency therefore receives an execution opportunity under the identity and environment of the agent running the skill. ### Attack Path 1. An attacker compromises the upstream package, a transitive dependency, a publisher account, or the configured Python package index. 2. The attacker publishes a malicious version that satisfies the unconstrained package request. 3. A user asks the skill to convert a PowerPoint file on a system where `python-pptx` is unavailable. 4. Following `SKILL.md`, the agent runs `pip install python-pptx`. 5. Pip selects and installs the attacker-controlled release into the active environment. 6. Malicious installation hooks ...[truncated 916 chars]
- Remediation
- ## Remediation Suggestions - Pin every dependency to an audited version, for example through a version-controlled requirements file. - Use hashes and require them during installation: ```text python-pptx==AUDITED_VERSION --hash=sha256:EXPECTED_HASH ``` ```bash python -m pip install --require-hashes -r requirements.txt ``` - Pin and hash transitive dependencies as well, using a reproducible lock-generation process. - Install dependencies inside a dedicated virtual environment rather than the user's global or shared Python environment. - Use `python -m pip` tied to the intended interpreter instead of an ambiguous `pip` executable. - Configure an approved package index and disable unexpected additional indexes to reduce dependency-confusion exposure. - Apply the same controls to the Pillow installation documented in `html-template.md`. - Prefer a prebuilt, reviewed execution environment where dependencies are installed before the skill runs. - Document that dependency installation causes third-party code to execute and require confirmation before changing the environment.