T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:41
- Finding
- Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:41-45`, and `SKILL.md:71` **Vulnerability Type**: Unpinned and automatically executed npm dependency **Risk Level**: Medium ### Complete Code Snippets ```yaml metadata: {"openclaw":{"emoji":"📄","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning it to an exact, previously reviewed version or enforcing a package integrity value. The metadata installation declaration, global npm installation, `npx` fallback, and explicit `@latest` upgrade can retrieve package contents that change after this Skill has been audited. npm packages may execute lifecycle scripts during installation. The installed `qhkit` executable also runs arbitrary code supplied by the package publisher. Global installation and `npx` therefore expose the host to code obtained from an external package registry under the privileges of the user running the Agent. The documented fallback to `registry.npmmirror.com` introduces an additional distribution dependency. Although it may be a legitimate mirror, using multiple mutable package sources expands the supply-chain trust boundary. The separate Node.js download procedure at `SKILL.md:49-50` is not a `curl | bash` operation. It downloads a fixed archive and validates it with `sha256sum` before extraction. The pipeline only filters checksum data and does not pipe downloaded code into a shell. It is consequently not treated as a confirmed remote-script execution vulnerability. ### Attack Path 1. An attacker compromises the npm publisher account, the `@iqinghu/qhkit` package, a configured registry, or a registry mirror. 2. The attacker publishes a malicious replacement under the unpinned package version o ...[truncated 1421 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version in both metadata and commands rather than using an unversioned package or `@latest`. 2. Verify the package using a trusted integrity digest or a committed lockfile before installation. 3. Remove automatic upgrades to `@latest`. Require explicit user approval and a new security review before changing versions. 4. Avoid global installation and automatic `npx` execution. Prefer a project-local, isolated installation with a controlled dependency manifest. 5. Where compatible with the package, install with npm lifecycle scripts disabled and separately review any scripts that must be enabled. 6. Restrict the CLI process to a sandbox with access only to the product assets required for the requested generation task. 7. Provide the API token through a narrowly scoped environment variable or protected credential mechanism, and prevent child processes from accessing unrelated secrets. 8. Use one explicitly trusted registry and document its trust assumptions. If a mirror is necessary, apply the same version and integrity verification. 9. Run dependency provenance, signature, malware, and vulnerability checks before approving each package release. ]]>