T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Package Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8-19 **Vulnerability Type**: Unpinned dependency execution through `uvx` **Risk Level**: Medium ### Vulnerable Code ```markdown Convert files to Markdown using `uvx markitdown` — no installation required. ## Basic Usage ```bash # Convert to stdout uvx markitdown input.pdf # Save to file uvx markitdown input.pdf -o output.md uvx markitdown input.docx > output.md # From stdin cat input.pdf | uvx markitdown ``` ``` ### Technical Analysis The documented commands direct users to execute `markitdown` through `uvx` without specifying an exact package version, dependency lockfile, package hash, or trusted repository configuration. `uvx` may resolve, download, cache, and execute the currently available package and its transitive dependencies. Because the resolved software is not fixed to the version reviewed with this Skill, the effective executable code can change independently of the Skill package. A compromised release, malicious transitive dependency, dependency-confusion event, or unexpected upstream update could therefore run arbitrary code when a user follows the documented instructions. No evidence was found that the currently published `markitdown` package is malicious. The finding concerns the unsafe and non-reproducible dependency execution method documented by the Skill. ### Attack Path 1. An attacker compromises a future `markitdown` release, one of its transitive dependencies, or the package-resolution source used by `uvx`. 2. The user follows the Skill documentation and runs an unpinned command such as `uvx markitdown input.pdf`. 3. `uvx` resolves and downloads the compromised package version or dependency. 4. Package initialization or document-processing code executes with the privileges of the invoking user. 5. The malicious code can access the supplied document and other resources available to that user, potentially including local files, environment variables, credenti ...[truncated 808 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `markitdown` to an exact version that has been reviewed, rather than allowing `uvx` to resolve the latest available release. For example: ```bash uvx --from 'markitdown==<reviewed-version>' markitdown input.pdf ``` 2. Use a lockfile or equivalent dependency manifest that fixes all transitive dependency versions. 3. Verify package artifacts with cryptographic hashes where supported, and obtain packages only from an explicitly configured trusted index. 4. Regularly review and deliberately update the pinned package and its dependency tree instead of accepting upstream changes automatically. 5. Document that the first invocation may access the network, download executable code, and cache dependencies. 6. Run document conversion in a sandbox or container with: - No unnecessary credentials or environment secrets. - Read-only access to input documents where practical. - Write access restricted to a dedicated output directory. - Limited network access. - No administrative or root privileges. ]]>