T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:37
- Finding
- Unpinned Tencent Cloud SDK Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37`; duplicated in the dependency error guidance at `scripts/main.py:219-223` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash pip install tencentcloud-sdk-python ``` ### Technical Analysis The installation guidance retrieves the current version of `tencentcloud-sdk-python` and its transitive dependencies from the configured Python package index without a version constraint or integrity hash. The dependency is relevant to the declared OCR functionality, and there is no evidence that its package name is intentionally deceptive. However, the installed code can change after this Skill has been audited. Consequently, review of the Skill repository does not establish the integrity of the code ultimately installed and executed. Python packages and their build systems can run code during installation, while imported SDK modules execute with the same privileges as the OCR script. If the package publisher, package-index account, distribution infrastructure, or a transitive dependency were compromised, a malicious release could execute code in the user's environment. ### Attack Path 1. An attacker compromises the SDK publishing account, a transitive dependency, or the configured package distribution channel. 2. The attacker publishes a malicious package version that remains compatible with the unpinned package name. 3. A user follows the documented `pip install tencentcloud-sdk-python` instruction. 4. The package manager resolves and installs the attacker-controlled version because no reviewed version or hash is required. 5. Malicious installation or import-time code executes with the privileges of the user running the installation or OCR script. 6. That code may access the Tencent Cloud credentials available to the process, read user-accessible invoice files, alter OCR requests or responses, or perform unrelated network activity. This path d ...[truncated 845 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the Tencent Cloud SDK to a specific version that has been reviewed and tested: ```text tencentcloud-sdk-python==REVIEWED_VERSION ``` 2. Store dependencies in a committed requirements or lock file rather than instructing users to install an unconstrained package directly. 3. Generate and require cryptographic hashes for the pinned package and all transitive dependencies. Install them with hash verification: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Update `SKILL.md` and the error message in `scripts/main.py` so both direct users to the reviewed, hash-locked dependency file. 5. Perform dependency updates through an explicit review process that includes package provenance verification, vulnerability scanning, release-note review, and regression testing. 6. Install and run the Skill in an isolated virtual environment or container under a non-privileged account. Expose Tencent Cloud credentials only for the duration of the OCR operation and scope those credentials to the minimum required Tencent Cloud permissions. ]]>