T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:51
- Finding
- Unpinned Third-Party Dependencies Are Installed and Executed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:51`, `SKILL.md:77`, and `SKILL.md:90` **Vulnerability Type**: Supply-chain exposure through mutable, unpinned dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to download and execute packages whose exact versions and integrity values are not pinned. The `@latest` specifier explicitly allows the executed implementation to change after the Skill has been audited. The unversioned `pip install pillow` and `npx --yes sharp-cli` commands similarly resolve mutable package versions at execution time. The global installation of `@iqinghu/qhkit` increases the affected scope relative to a project-local or isolated installation. Package lifecycle scripts and subsequently invoked package code execute with the privileges of the Agent's operating-system account. The use of third-party registry mirrors as fallbacks introduces additional distribution infrastructure that must be trusted. This is not evidence that the named packages are currently malicious. The vulnerability is that future package releases, compromised publisher accounts, registry compromise, or dependency substitution could cause unaudited code to execute automatically. ### Attack Path 1. An attacker compromises a package publisher, package release process, registry account, registry mirror, or transitive dependency. 2. The attacker publishes a malicious release that satisfies the unpinned package request or becomes the package's `latest` version. 3. The Agent follows the Skill instructions and runs `npm`, `pip`, or `npx`. 4. The package manager downloads the attacker-controlled release. 5. Installation lifecycle code or the requested executable runs w ...[truncated 972 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version rather than using an implicit current version or `@latest`. 2. Record and verify package integrity hashes. For npm packages, use a lockfile with integrity metadata and a reproducible installation command such as `npm ci`. 3. For Python dependencies, use a locked requirements file containing exact versions and hashes, and install with `pip --require-hashes`. 4. Avoid global installation. Install dependencies into a dedicated project directory, virtual environment, container, or other sandbox with only the required filesystem and network access. 5. Replace automatic `npx --yes` execution with a pinned, pre-reviewed dependency installed from the lockfile. 6. Verify package ownership and provenance before installation. Where supported, validate registry signatures, attestations, and published checksums. 7. Do not switch registries automatically. Require explicit user approval for mirror use and document the additional trust boundary. 8. Upgrade dependencies through a reviewed change process rather than automatically installing the newest release when an error occurs. ]]>