Vet Every Dependency

Suppose the assistant's code for splitting amounts begins with pip install rupee-split-pro. The name sounds reasonable and the install line looks routine. But a package is code written by strangers that will run with all of Kitty's permissions, and the assistant may have suggested it from a pattern rather than from knowledge that it exists and is trustworthy.

The rule

Before installing a suggested package, confirm it exists, is trusted and is needed.

A dependency is someone else's package that your project installs and runs. Assistant-suggested dependencies carry particular risks:

• Invented names. An assistant can suggest a package name that sounds right but does not exist. Attackers have been known to register plausible invented names and fill them with harmful code, waiting for someone to install them.
• Look-alike names. A name one letter away from a popular package, published to catch typing slips.
• Stale knowledge. An assistant may suggest an old version, or a package that has since been abandoned or found to have security problems.
• No need at all. A whole library for something your language already does. Python's built-in decimal module handles exact money arithmetic, and Kitty's own tested split function is a dozen lines.

For each package that passes, pin the version you reviewed in your requirements file, and check your dependencies for published security advisories from time to time, so an unreviewed release cannot slip in unnoticed.

The shortcut

Three checks, and any "no" means do not install: Exists? It is on the official package index under exactly that spelling, with a real history. Trusted? It is widely used, maintained, documented and links to its source code. Needed? The standard library or an existing dependency cannot already do the job.

This lesson closes the course's safety checks. Before you share Kitty with anyone, run all four from this section: no secrets in code, history or prompts; every input checked, parameterised and escaped; every request checking what the user may do; and every dependency existing, trusted and needed.

Drills

Answer fast — trust the rule.

Remember

• Rule: before installing a suggested package, confirm it exists, is trusted and is needed.
• Shortcut: exists, trusted, needed. Any "no" means do not install.
• Trap: a plausible name and a routine-looking install line. Before sharing, run all four security checks.