AI libraries installed without a pinned version
LowAV-DEP-003Supply chainCore packNew in 2.0
What it finds
requirements.txt lists AI libraries with no version or only a minimum version.
Why it matters
These libraries change fast and have had serious security fixes. Unpinned installs can pull in a breaking or compromised release without anyone noticing.
What an attacker could do: A new upstream release changes what your agent runs.
How to fix it
Pin exact versions (==) and use a lock file with hashes (pip-tools, uv, or poetry).
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- AI_DEPENDENCY_UNPINNED
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM05 - Supply Chain Vulnerabilities
- NIST AI RMF
- GV-6.1
- SOC 2
- CC8.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.