T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 4, 39, and 69 **Vulnerability Type**: Supply-chain exposure through mutable npm dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"📑","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to install and execute `@iqinghu/qhkit` without pinning an exact version or cryptographic package integrity value. The explicit use of `@latest` also permits the installed implementation to change after the Skill has been reviewed. npm installations may execute package lifecycle scripts. The installed CLI subsequently receives an API token and processes local image paths, giving it access to data available to the invoking user. Global installation unnecessarily increases the persistence and scope of the dependency compared with an isolated, task-specific installation. The instructions also permit using `registry.npmmirror.com` as an alternative registry. Although described as a network fallback, this introduces another supply-chain trust path without requiring independent package-integrity verification. ### Attack Path 1. An attacker compromises the npm package publisher account, a transitive dependency, a registry endpoint, or the alternative mirror. 2. The attacker publishes or serves a malicious release under the expected package name. 3. The Agent runs the unpinned global installation command or installs `@latest`. 4. Malicious lifecycle scripts execute during installation, or malicious code executes when `qhkit` is invoked. 5. The malicious package accesses files, environment variables, API tokens, or network resources available to the invoking account. ### Impact Assessment Successful exploitation permits code execution with ...[truncated 541 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a reviewed exact version rather than using an implicit current version or `@latest`. 2. Maintain a lockfile containing package-integrity hashes and install through a reproducible process such as `npm ci`. 3. Prefer a project-local, temporary installation over global installation. 4. Run the CLI in a sandbox or container with access restricted to the required input images and output directory. 5. Disable npm lifecycle scripts with `--ignore-scripts` if the package can operate without them. Otherwise, review all required lifecycle scripts before installation. 6. Use one explicitly trusted registry and verify package integrity independently when falling back to a mirror. 7. Limit the process environment so the CLI receives only the required API token and cannot read unrelated credentials. 8. Require explicit user approval before installing or upgrading executable third-party dependencies.