T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 47-51 **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit direct execution through an unpinned package reference: ```bash npx @iqinghu/qhkit <command> ... ``` ### Technical Analysis The Skill instructs the Agent to install `@iqinghu/qhkit` globally without specifying a reviewed version or integrity hash. It also provides an `npx` fallback that may download and execute the package dynamically. Consequently, the code executed at runtime can differ from the code available when the Skill was audited. NPM installation can execute package lifecycle scripts. If the package, publisher account, dependency tree, registry response, or configured mirror is compromised, attacker-controlled code could run during installation or subsequent CLI invocation. Global installation unnecessarily increases the affected scope compared with a local, isolated installation. The later instruction to upgrade using `@latest` further prevents the Skill from maintaining a stable, reviewable dependency version. ### Attack Path 1. An attacker compromises the package publisher account, the package itself, a transitive dependency, or a package registry response. 2. The compromised component publishes malicious code under a version that satisfies the unpinned installation request. 3. The Agent follows the automatic bootstrap or upgrade instructions. 4. `npm` or `npx` retrieves the mutable package and executes its installation scripts or CLI entry point. 5. The malicious code executes with the privileges of the Agent process and can access files, environment variables, credentials, media, and network resources available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the operati ...[truncated 578 chars]
- Remediation
- ## Remediation Suggestions - Pin `@iqinghu/qhkit` to a specifically reviewed version instead of using an implicit latest version or `@latest`. - Verify package integrity using a lockfile and registry integrity metadata. - Install the package locally in a dedicated, minimally privileged working directory rather than globally. - Avoid `npx` execution that implicitly downloads packages. If unavoidable, specify an exact reviewed version and disable lifecycle scripts where compatible. - Require explicit user approval before installing or upgrading executable dependencies. - Run the CLI in a sandbox or container with restricted filesystem access, a controlled environment, and limited outbound network access. - Pin and review transitive dependencies, and use a trusted registry with provenance or signature verification. - Do not automatically switch to alternate package registries without separately establishing their trust and integrity guarantees.