T08 · Insecure Dependencies
Error
- Location
- SKILL.md:53
- Finding
- Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 53–91 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` The instructions also permit alternate registries: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the agent to install or immediately execute mutable third-party packages without pinning exact versions or verifying package integrity. The global installation of `@iqinghu/qhkit`, the explicit use of the mutable `latest` tag, and `npx --yes` execution all allow package code to change after the Skill has been audited. NPM packages can run lifecycle scripts during installation, while packages invoked through `npx` execute code under the current agent user's account. The alternate NPM and Python registries expand the number of infrastructure components that must be trusted. No lockfile, package integrity value, package signature, or independently pinned digest is specified. These package installations are not inherently malicious, but they create a supply-chain execution channel that exceeds the minimum privilege necessary. A safer design would require a preinstalled, vetted CLI or a package pinned to a reviewed version and integrity digest rather than automatically installing arbitrary future releases. The nearby Node.js download pipeline is not a `curl | bash` operation. It downloads an archive and checks it using `sha256sum -c` before extraction. Therefore, that specific pipeline is not classified as remote shell execution. Its checksum is nevertheless obtained from the same distribution endpoint as the archive, so an independently pinned checksum would provi ...[truncated 1496 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every executable dependency to a reviewed exact version, for example: ```bash npm install -g @iqinghu/qhkit@<reviewed-version> ``` 2. Record and verify package integrity hashes or signatures before installation. Use a lockfile where possible. 3. Remove `@latest` and prohibit automatic upgrades based solely on remote error messages. 4. Avoid `npx --yes`, which downloads and executes packages without interactive review. Use a locally installed, pinned binary instead. 5. Prefer a preinstalled and administrator-vetted `qhkit` executable. If installation is necessary, obtain explicit user approval before executing package-manager commands. 6. Install packages into an isolated, nonprivileged environment rather than globally. 7. Pin and verify Pillow and `sharp-cli` versions. Prefer already installed image-processing tools over dynamic installation during a Skill run. 8. Use only an approved registry. Do not silently switch to alternate mirrors; require explicit approval and equivalent integrity verification. 9. Run third-party tooling in a sandbox with restricted filesystem access, a minimal environment, and outbound-network controls. 10. Independently pin the expected Node.js archive checksum in the reviewed Skill rather than relying exclusively on a checksum fetched from the same distribution origin. ]]>