T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:32
- Finding
- Unpinned Third-Party Dependencies Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:32-38`; repeated in `references/implementation.md:23-28` and `references/errors.md:34-41` **Vulnerability Type**: Unpinned and integrity-unverified third-party dependencies **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash pip install pandas numpy yfinance matplotlib ``` ```bash pip install ta-lib scipy scikit-learn ``` ### Technical Analysis The installation instructions do not constrain dependency versions or verify package integrity with cryptographic hashes. As a result, package resolution depends on the current state of the configured Python package index and the user's pip configuration at installation time. This makes the installed code mutable after the Skill has been reviewed. A compromised upstream release, dependency-confusion condition involving an untrusted package index, or unexpected incompatible release could introduce arbitrary installation-time or runtime behavior. The project does not include a lock file or hash-verified requirements file that would allow users to reproduce the audited dependency set. The audit did not identify an intentionally malicious package in the listed dependencies. The issue is the absence of controls that ensure users install the same reviewed package artifacts. ### Attack Path 1. An attacker compromises a listed dependency, one of its transitive dependencies, or a package source trusted by the victim's pip configuration. 2. The attacker publishes a malicious package version or artifact that satisfies the unconstrained dependency request. 3. A user follows the Skill instructions and executes the unpinned `pip install` command. 4. Pip resolves and installs the attacker-controlled artifact because no approved version or hash is enforced. 5. Malicious code executes during package installation or when the package is imported by the backtesting scripts. ### Impact Assessment Successful exploitation would ex ...[truncated 503 chars]
- Remediation
- ## Remediation Suggestions 1. Create a reviewed dependency lock file containing exact versions for direct and transitive dependencies. 2. Record cryptographic hashes and install with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a dedicated virtual environment rather than a shared or system-wide Python installation: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` 4. Configure pip to use an explicitly trusted package index and avoid untrusted extra indexes. 5. Regularly review and update pinned versions through a controlled dependency-update process. 6. Replace every unpinned installation command in `SKILL.md`, `references/implementation.md`, and `references/errors.md` with the same reproducible installation procedure.