T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:54
- Finding
- Unpinned Third-Party Packages Are Installed and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 54–57, 76–82, and 93 **Vulnerability Type**: Supply-chain exposure through unpinned package installation **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i input-image -o compressed-image.jpg resize 2048 ``` ### Technical Analysis The Skill directs the Agent to install and execute third-party npm and Python packages without pinning reviewed versions or package integrity hashes. In particular: - A bare `npm i -g @iqinghu/qhkit` resolves whatever version is current at execution time. - `@latest` explicitly retrieves a mutable release rather than a reviewed version. - `npx` can download and immediately execute a package that is not already installed. - `npx --yes` suppresses the interactive installation prompt. - Pillow and `sharp-cli` are installed without fixed versions. - Alternate npm and Python registries introduce additional supply-chain trust. - Global npm installation broadens the package's reach and can execute npm lifecycle scripts during installation. This means the effective code executed by the Skill can change after the Skill itself has been audited. The installation instructions are related to the declared functionality, but automatic unpinned installation exceeds the minimum-risk approach because dependencies could instead be version-locked and installed in an isolated environment. The flagged checksum command at line 63 is not a `curl | bash` execution chain. It downloads a checksum manifest and passes it through `grep` to `sha256sum -c`. That specific command therefore is not the vulnerability described here. ### Attack Path 1. An attacker compromises a referenced package publisher account, upstream package, or configured package registry. 2. The attacke ...[truncated 1443 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to a specifically reviewed version, including `@iqinghu/qhkit`, Pillow, and `sharp-cli`. 2. Remove `@latest` from automated upgrade instructions. Require a separate review before changing the pinned version. 3. Use npm lockfiles and integrity metadata where possible. Verify downloaded package artifacts against trusted hashes or signatures. 4. Avoid `npx --yes` for packages that have not already been installed and verified. Invoke a locally pinned binary instead. 5. Install dependencies in a dedicated project directory, virtual environment, or restricted container rather than globally. 6. Disable npm lifecycle scripts during installation when they are unnecessary, then explicitly run only reviewed setup steps. 7. Use the official package registry by default. If a mirror is necessary, document its trust boundary and verify that package integrity matches the official source. 8. Run image-processing tools with only the filesystem and network permissions required for the specific input and output files. 9. Maintain an allowlist of reviewed dependency names, versions, hashes, and expected publishers.