T08 · Insecure Dependencies
Error
- Location
- SKILL.md:48
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48–87 **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: High ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to download and execute third-party packages that are not included in, pinned by, or verifiable from the audited project. The primary `qhkit` dependency is installed globally without an exact version. The upgrade instruction explicitly installs `@latest`, allowing the code executed by the Agent to change after this Skill has been reviewed. The image-processing fallback similarly installs Pillow from an alternate package index or uses `npx --yes` to download and immediately execute `sharp-cli`. This creates a time-of-check/time-of-use supply-chain gap. Static review of `SKILL.md` cannot establish the safety of package versions that will be selected later. Global installation also has a broader effect on the host than a local, isolated installation and is not the minimum privilege or scope necessary for a single Skill invocation. The Node.js checksum command at line 57 is not a `curl | bash` execution chain. It pipes an official checksum manifest through `grep` into `sha256sum -c`, and the instructions require successful verification before extraction. That particular pipeline is a security control rather than direct remote script execution. It does not, however, address the separate risk from subsequently installing unpinned npm and Python packages. ### Attack Path 1. An attacker compromises a maintainer account, an upstream package, a transitive dependency, or one of the configured package registries. 2. The attacker publishes a malicious release under a pack ...[truncated 1408 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version. Do not use implicit latest versions or `@latest`. 2. Record and verify package integrity hashes or distribute a lockfile produced from reviewed dependencies. 3. Replace global npm installation with a project-local installation in an isolated working directory. 4. Avoid `npx --yes`, which downloads and immediately executes mutable remote content. 5. Preinstall reviewed image-processing dependencies in a controlled runtime image instead of installing them during Skill execution. 6. Prefer official registries. If mirrors are necessary, document their trust model and require integrity verification independent of the mirror. 7. Disable or tightly control dependency lifecycle scripts where operationally possible. 8. Run external tooling in a sandbox with restricted filesystem access, a minimal environment, and limited outbound network access. 9. Replace automatic upgrades with an explicit administrator-controlled review and deployment process. 10. Do not recommend privilege elevation when global installation fails; retain the existing non-root principle and use an isolated local installation instead. ]]>