T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 47 and 65 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit executing the package through `npx` and retrieving it from an alternative npm registry if the primary registry is unavailable. ### Technical Analysis The Skill instructs the Agent to retrieve and execute a mutable third-party npm package that is not included in the audited artifact. The initial installation does not specify an exact version, and the upgrade command explicitly selects `@latest`. Consequently, the code executed by the Agent can change after the Skill has been reviewed. npm installation may execute package lifecycle scripts in addition to installing the declared CLI binary. A global installation also places the executable in a shared npm prefix, giving the dependency broader persistence and influence over subsequent sessions than a task-local installation requires. The alternative registry fallback introduces an additional software-distribution trust boundary. The artifact does not establish that `@iqinghu/qhkit` is malicious. The risk arises because its implementation, lifecycle scripts, release integrity, and future versions cannot be verified from this project. The separately flagged Node.js installation does not pipe remote content into a shell. It downloads an archive and checksum manifest from the same official distribution endpoint, verifies the archive with `sha256sum -c`, and only then extracts it. That sequence is therefore not treated as a confirmed remote-script execution vulnerability. ### Attack Path 1. An attacker compromises the npm package maintainer account, package release process, npm distribution channel, or permitted mirror. 2. The attacker publishes a malicious release under `@iqinghu/qhkit` or modifies a r ...[truncated 1451 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mutable package selectors with an audited exact version, for example `@iqinghu/qhkit@X.Y.Z`, and update that version only through a reviewed release process. 2. Verify package integrity against a trusted, independently recorded digest before execution. Do not rely solely on metadata obtained from the same registry serving the package. 3. Prefer a project-local installation governed by a committed lockfile and integrity metadata instead of a global installation. 4. Avoid automatic `@latest` upgrades. Present the proposed version and release information to the user and require explicit approval before upgrading. 5. Disable npm lifecycle scripts during installation where compatible, such as with `--ignore-scripts`, and separately review any installation steps genuinely required by the package. 6. Execute the CLI in a sandbox or restricted account with access limited to the images required for the current task. Do not expose unrelated directories, credentials, or environment variables. 7. Obtain explicit user consent before uploading local images to the external LinkPix service, especially when files may contain confidential product information. 8. Avoid switching to an alternative registry unless its provenance is approved and the downloaded artifact is verified against an independently trusted digest. 9. Document the package publisher, reviewed version, expected binaries, lifecycle behavior, network destinations, and required permissions so future changes can be detected.