T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:45
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 45-51 and 66-72 **Vulnerability Type**: Third-party supply-chain exposure through mutable npm package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The surrounding instructions also permit direct execution through `npx`: ```text Only when global installation fails due to permissions and privilege elevation is unavailable, fall back to `npx @iqinghu/qhkit <command> ...`. ``` The upgrade procedure installs the latest available release without pinning a reviewed version: ```bash npm i -g @iqinghu/qhkit@latest ``` If the official npm registry is unavailable, the instructions additionally permit installation through: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill instructs the Agent to download and execute the third-party npm package `@iqinghu/qhkit`. Neither the initial installation nor the upgrade command pins an exact reviewed version or package integrity hash. In particular, the use of `@latest` means that the effective executable code can change after this Skill has been audited. npm installation can execute package lifecycle scripts, while the installed CLI subsequently runs with the permissions of the Agent's operating-system account. The CLI is expected to receive local image and video paths and an authentication token through `qhkit config set` or the `QHKIT_TOKEN` environment variable. Consequently, a compromised package release, publisher account, registry response, or distribution mirror could expose both local data and service credentials. Global installation is broader than necessary for invoking the declared image and video processing functionality. It modifies the user's shared executable environment and makes the dependency available to unrelated sessions. The fallback to `npx` avoids a persistent global installation but still downloads and i ...[truncated 2223 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than using an unversioned package name or `@latest`. 2. Verify package integrity using an approved lockfile, npm integrity metadata, or a separately pinned cryptographic digest. 3. Remove automatic upgrade instructions based solely on CLI or server-provided messages. Require review and approval before changing the installed version. 4. Prefer a project-local installation over `npm i -g` so the dependency does not modify the user's shared executable environment. 5. Avoid unrestricted `npx` execution of packages that are not already present and verified locally. 6. Disable npm lifecycle scripts with `--ignore-scripts` where compatible. If lifecycle scripts are required, review them before installation. 7. Run the CLI in an isolated container or sandbox with access only to the media files required for the current request. 8. Supply a short-lived, narrowly scoped service token and prevent the process from accessing unrelated credentials or sensitive environment variables. 9. Treat registry mirrors as separate supply-chain dependencies. Permit them only when their provenance, synchronization policy, and integrity controls have been assessed. 10. Document the reviewed package version, integrity value, expected network destinations, and required filesystem permissions in the Skill.