T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:46
- Finding
- Unpinned Global Installation of a Third-Party Executable npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 42–47 and 68–71 **Vulnerability Type**: Supply-chain exposure through unpinned, globally installed executable dependencies **Risk Level**: Medium ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the agent to globally install the third-party `@iqinghu/qhkit` npm package without pinning it to a reviewed version. It also directs the agent to install the latest available release automatically when certain responses or notices are encountered. npm installation can execute package lifecycle scripts, while the resulting `qhkit` executable subsequently processes local image paths and an API token. The installed package therefore executes with the permissions of the agent's operating-system account and can access resources available to that account. Global installation also modifies shared user-level or system-level tooling beyond what is strictly required for a single image-generation task. A project-local, pinned installation would provide a narrower trust and modification boundary. The optional use of an alternative npm registry introduces an additional supply-chain trust point. The audit did not inspect the external package, its releases, or the registry infrastructure; consequently, this finding identifies unsafe dependency acquisition practices rather than evidence that the current package is malicious. The separately flagged checksum pipeline is not remote shell execution. It sends the downloaded checksum manifest to `grep` and `sha256sum`, not to a command interpreter, and the instructions require successful verification before archive extraction. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, a future package release, or a configured registry distribution path. 2. The compromised version publishes malicious lifecycle code or a malicious `qhkit` executab ...[truncated 1419 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version instead of using an implicit current version or `@latest`. 2. Record and verify the expected package integrity hash or use a lockfile with integrity metadata. 3. Remove automatic upgrade instructions based solely on CLI-controlled messages. Require explicit user approval and security review before changing versions. 4. Prefer a project-local installation over `npm i -g` to minimize changes to shared tooling and constrain the installation scope. 5. Execute the dependency in a sandbox or restricted service account with access only to the intended input images and required network endpoints. 6. Disable npm lifecycle scripts during installation where compatible, and separately review any required scripts before allowing them to execute. 7. Prefer the official npm registry. If a mirror is necessary, document its trust assumptions and verify that downloaded package integrity matches the expected official artifact. 8. Avoid storing the API token in broadly accessible configuration. Supply it through a scoped secret mechanism and ensure it is not exposed in command history, logs, or subprocess output. 9. Review the installed package contents and transitive dependencies before deployment, including lifecycle scripts, network behavior, file access, and credential handling.