T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Unpinned Third-Party Package and Plugin Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 7–19 and 35–40 **Vulnerability Type**: Unpinned dependency retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```markdown Convert files to Markdown using `uvx markitdown` — no installation required. ## Basic Usage ```bash # Convert to stdout uvx markitdown input.pdf # Save to file uvx markitdown input.pdf -o output.md uvx markitdown input.docx > output.md # From stdin cat input.pdf | uvx markitdown ``` ``` The optional plugin-related commands are also documented at lines 35–40: ```markdown ```bash -d # Use Azure Document Intelligence -e ENDPOINT # Document Intelligence endpoint --use-plugins # Enable 3rd-party plugins --list-plugins # Show installed plugins ``` ``` ### Technical Analysis The Skill directs the Agent to execute `uvx markitdown` without specifying an exact package version, lockfile, integrity hash, or trusted package index. `uvx` can resolve, retrieve, cache, and execute a package from an external package repository. Consequently, the code executed at invocation time is not fully represented by the reviewed Skill and may change after publication. The `--use-plugins` option further expands the executable dependency surface to third-party plugins without specifying an allowlist, approved versions, or integrity controls. This does not establish that the current package or any plugin is malicious, but it creates a supply-chain exposure if an upstream release, package source, maintainer account, dependency, or installed plugin is compromised. ### Attack Path 1. An attacker compromises an upstream `markitdown` release, one of its transitive dependencies, a package-maintainer account, or a third-party plugin available in the execution environment. 2. The Agent follows the Skill and invokes the unversioned `uvx markitdown` command, optionally with `--use-plugins`. 3. `uvx` resolves and ...[truncated 1279 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `markitdown` to an exact, reviewed version in every command, using the version-selection syntax supported by `uvx`. 2. Maintain a reviewed lockfile or equivalent dependency manifest covering all transitive dependencies. 3. Require cryptographic hashes or repository integrity verification where supported. 4. Configure package resolution to use an explicitly trusted registry and reject unintended fallback indexes. 5. Test and approve dependency upgrades before changing the pinned version. 6. Disable third-party plugins by default. If plugins are necessary, allowlist individually reviewed plugins and pin their exact versions and hashes. 7. Run conversion in a restricted sandbox with minimal filesystem access, no unnecessary credentials, and network access disabled unless specifically required. 8. Process untrusted documents in an isolated temporary workspace and restrict output writes to an explicitly approved path. 9. Update the documentation to disclose that `uvx` may retrieve and cache dependencies rather than implying that no dependency installation or retrieval occurs.