T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned Third-Party CLI Is Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 43–64 **Vulnerability Type**: Unpinned npm dependency installation and execution **Risk Level**: Medium **Relevant Code Snippet**: ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning it to an audited version or integrity value. It also recommends installing the package globally and automatically upgrading to the latest available release. npm packages can execute package lifecycle scripts during installation, while the installed CLI can perform arbitrary operations under the privileges of the Agent's operating-system account. Because no exact version, lockfile, or integrity hash is specified, the code executed when the Skill is used can differ from the code that existed when the Skill was reviewed. The `npx` fallback does not remove this risk because it can download and immediately execute the currently resolved package version. Use of the optional npm mirror further expands reliance on external package-distribution infrastructure, although the documented mirror is not itself evidence of malicious behavior. Global installation is broader than necessary for the declared image-processing functionality. A project-local, version-pinned installation would reduce filesystem scope and make the effective dependency version reproducible. ### Attack Path 1. An attacker compromises the npm publisher account, package registry path, distribution mirror, or a transitive dependency used by `@iqinghu/qhkit`. 2. The attacker publishes a malicious release under the same package name or causes the unpinned request to resolve to a compromised dependency. 3. The Agent follows the bootstrap or upgrade instructions and runs `npm i -g @iqinghu/qhkit`, `npx @iqinghu/qhkit`, or `npm i -g @iqinghu/qhkit@latest` ...[truncated 1164 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version rather than using an unversioned package or `@latest`. 2. Record and verify package integrity through a committed lockfile, npm integrity metadata, or an independently maintained checksum. 3. Prefer a project-local installation over `npm i -g` to limit filesystem scope and improve reproducibility. 4. Require explicit user approval before installing or upgrading executable dependencies. 5. Do not automatically execute upgrade commands supplied through CLI output. Validate any requested version against an approved version list first. 6. Where compatible, install with lifecycle scripts disabled and explicitly review any scripts required by the package before enabling them. 7. Run the CLI in a sandbox or restricted account with access only to the input images and output directory required for the task. 8. Provide the API token only to the generation process, avoid placing it in command history, and remove it from the environment after use. 9. Document the package version and registry used for each execution so installations can be audited and reproduced.