T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Unpinned Third-Party CLI Installation and Automatic Upgrade## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:40-47`, and `SKILL.md:62-68` **Vulnerability Type**: Unpinned executable dependency and unsafe automatic upgrade **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🛠️","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit on-demand execution through an unpinned package name: ```bash npx @iqinghu/qhkit <command> ... ``` Automatic upgrades explicitly install the publisher-controlled latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` A fallback registry is also permitted: ```bash npm i -g @iqinghu/qhkit@latest --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning an audited version or package integrity value. Both the implicit latest version and the explicit `@latest` upgrade allow the effective executable code to change after the Skill has been reviewed. `npx` can likewise retrieve and immediately execute the currently resolved package release. npm packages may execute lifecycle scripts during installation and then run with the privileges of the Agent's operating-system account. A global installation increases the dependency's system-wide visibility within that user environment. The Skill subsequently gives this CLI access to a LinkPix API token and directs it to read and upload user-selected local media. No evidence establishes that the current package is malicious. The vulnerability is the absence of controls that would prevent a compromised publisher account, registry response, mirror, or future release from introducing malicious code. The separately flagged checksum command at `SKILL.md:53` is not a `curl | bash` pattern: ```bash cd /tmp && curl -fsSL https://nodejs.org/di ...[truncated 2402 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific audited version everywhere, including Skill metadata, installation commands, and `npx` examples. 2. Remove automatic `@latest` upgrades. Treat each upgrade as a reviewed change and update the pinned version only after verification. 3. Prefer a project-local installation with a committed lockfile over global installation, reducing scope and making dependency resolution reproducible. 4. Verify the package tarball using a trusted, independently recorded integrity value before installation. Do not rely solely on mutable registry metadata. 5. Where practical, install with lifecycle scripts disabled and explicitly review any scripts required by the package before permitting them. 6. Avoid on-demand unpinned `npx` execution. If `npx` is necessary, specify the exact approved version and prevent silent substitution. 7. Use only trusted registries. If a mirror is required, verify that its resolved package integrity matches the independently approved artifact. 8. Run the CLI in a sandbox with access limited to the specific media files required for the task. Restrict filesystem, environment-variable, and network access where supported. 9. Supply the LinkPix token only to the command that needs it, avoid persisting it unnecessarily, and use a narrowly scoped, revocable credential. 10. Document the remote service endpoints, media-upload behavior, retention policy, and credential handling so users can provide informed consent. 11. For the Node bootstrap, embed the expected SHA-256 digest in the reviewed Skill or validate it against an independently trusted, signed release manifest.