T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Automatic Installation and Execution of an Unpinned Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:47-51`, and `SKILL.md:72` **Vulnerability Type**: Insecure third-party dependency installation and execution **Risk Level**: Medium ### Complete Code Snippet ```yaml metadata: {"openclaw":{"emoji":"👗","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```text Only when global installation fails because of permissions and privilege elevation is unavailable, fall back to: npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute the external npm package `@iqinghu/qhkit` automatically. The dependency is not pinned to a reviewed version, and no npm integrity value, lockfile, vendored source, or reproducible verification mechanism is provided. Both global installation and `npx` can execute npm lifecycle scripts and package-provided code with the privileges of the current Agent process. The explicit use of `@latest` also means that the effective executable may change after this Skill has been audited. Consequently, future package releases can introduce behavior that is absent from the reviewed `SKILL.md`. This is primarily an insecure dependency and software supply-chain risk. There is no evidence in the audited file that the current package is malicious, but the Skill delegates local execution to mutable, unaudited remote code. Global installation also exceeds the minimum practical scope because a project-local or isolated installation could provide the required command without modifying the user's global npm environment. The separately flagged Node.js checksum command is not a `curl | bash` execution pattern. It pipes a checksum manifest to `grep` and `sha256sum`, verifies the archive before extraction, and installs it in the user's home directory without root. It therefore does not consti ...[truncated 1699 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has undergone source and behavior review. Do not use an open-ended version or `@latest`. 2. Record and verify the package tarball integrity hash, and use a lockfile or an equivalent reproducible dependency manifest. 3. Avoid automatic global installation. Install the package in a dedicated project directory, container, sandbox, or ephemeral environment with least-privileged filesystem and network access. 4. Require explicit user approval before installing or upgrading executable dependencies. 5. Disable npm lifecycle scripts during installation where compatible, for example with `--ignore-scripts`, and separately review any required installation scripts before permitting them. 6. Prefer a pre-reviewed executable artifact or vendored source whose contents cannot change independently of the audited Skill. 7. Restrict the runtime's access to unrelated files and environment variables. Provide `QHKIT_TOKEN` only to the specific command that requires it, and avoid exposing unrelated credentials. 8. Inform users before local images are uploaded to the third-party service and obtain consent, particularly where images may contain personal data or sensitive metadata. 9. If a registry mirror is used, verify that it serves the expected package and integrity value rather than treating the mirror as an equivalent trust source automatically. 10. Replace automatic upgrade instructions with a controlled process that reviews release notes, package contents, integrity metadata, and dependency changes before installation. ]]>