T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:54
- Finding
- Unpinned Third-Party Packages Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 54-57, 80, and 93 **Vulnerability Type**: Unpinned dependencies and automatic package execution **Risk Level**: Medium ### Vulnerable Code Snippets ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i INPUT_FILE -o OUTPUT_FILE.jpg resize 2048 ``` The instructions also permit executing `@iqinghu/qhkit` through `npx` and switching npm operations to `https://registry.npmmirror.com`. ### Technical Analysis These commands resolve package versions dynamically at installation time. In particular, `@latest` and `npx --yes` permit a newly published package version to be downloaded and executed without prior review. No lockfile, exact version, or package-integrity value constrains the effective code. Package installation and execution can invoke package lifecycle scripts and runtime code with the permissions of the Agent process. Global npm installation also modifies the user's shared command environment, which exceeds the minimum scope required for a single Skill invocation. The use of multiple package mirrors increases the number of supply-chain systems that must remain trustworthy. The checksum-verified Node.js download at lines 62-67 is not the source of this finding. That archive uses a fixed version, is obtained from the official Node.js distribution service or a documented mirror, and must pass SHA-256 verification before extraction. ### Attack Path 1. An attacker compromises a package maintainer account, registry, mirror, or an upstream dependency. 2. The attacker publishes a malicious version of `@iqinghu/qhkit`, `sharp-cli`, Pillow, or a transitive dependency. 3. The Agent follows the Skill instructions and invokes an unpinned install, `@latest`, or `npx --yes`. 4. The registry resolves the malicious version ...[truncated 876 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version rather than using floating versions or `@latest`. 2. Record and verify package integrity hashes through a lockfile or equivalent trusted manifest. 3. Remove automatic `npx --yes` execution. Install a reviewed version in an isolated project directory before invoking it. 4. Prefer a local, non-global npm installation so the Skill does not modify the user's shared command environment. 5. Run package installation and image processing inside a sandbox with restricted filesystem and network access. 6. Disable package lifecycle scripts during installation where compatible, then explicitly execute only reviewed entry points. 7. Use one documented trusted registry. If mirrors are necessary, establish equivalent integrity and provenance controls. 8. Pin Pillow and `sharp-cli` versions as well as the primary `qhkit` package. 9. Require explicit user approval before installing or upgrading executable dependencies.