T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:52
- Finding
- Unpinned Third-Party Packages Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 52–91 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i source-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to retrieve and execute third-party packages without pinning exact versions or verifying package integrity. In particular: - `npm i -g @iqinghu/qhkit` resolves the version at installation time. - `@latest` explicitly selects a mutable release pointer. - `npx` can download and immediately execute a package that is not already installed. - `npx --yes` suppresses the normal interactive installation prompt. - Pillow is installed from an external Python package mirror without a pinned version or hash. - The primary CLI is installed globally even though a local or isolated installation would be sufficient for the declared task. These instructions create a supply-chain trust dependency on package maintainers, registry accounts, registry infrastructure, mirrors, and all transitive dependencies. A compromised account, malicious future release, dependency confusion event, or registry compromise could cause attacker-controlled code to execute under the Agent's operating-system account. The separately flagged command at line 61 is not a `curl | bash` execution pipeline. It downloads a checksum manifest and passes text through `grep` to `sha256sum`: ```bash cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` That command does not directly execute the downloaded response and therefore is not itself confirmed as remote payload execution. However, obtaining both the archive and its checksum from th ...[truncated 1900 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact, reviewed version instead of using implicit current versions or `@latest`: ```bash npm install --prefix "$WORKDIR/qhkit-runtime" @iqinghu/qhkit@<reviewed-version> python -m pip install pillow==<reviewed-version> ``` 2. Record and verify package integrity using a reviewed lockfile, npm integrity metadata, or independently stored cryptographic hashes. 3. Remove automatic use of `npm i -g` and `npx --yes`. Install dependencies inside a dedicated temporary project, container, or other isolated environment. 4. Do not automatically upgrade in response to remote CLI messages. Present the proposed exact version to the user, require approval, and verify that release before installation. 5. Restrict package lifecycle scripts where compatible: ```bash npm install --ignore-scripts --save-exact <package>@<version> ``` If lifecycle scripts are required, review them before allowing execution. 6. Prefer the official package registry. If a mirror is necessary, pin the expected package hashes so that mirror compromise cannot silently replace artifacts. 7. Run media-processing dependencies with minimum filesystem and network access. Expose only the specific input and output files needed for the operation. 8. Pass API credentials through a secret manager or scoped environment variable. Do not ask users to place reusable API keys directly in conversation text, and ensure child processes receive the token only when required. 9. For the Node.js bootstrap, retain checksum verification but pin the expected checksum in reviewed Skill content or validate a signed release manifest through an independently trusted key. ]]>