T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Unpinned Global Installation and Automatic Upgrade of a Third-Party CLI<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40-61` **Vulnerability Type**: Supply-chain exposure through an unpinned executable npm dependency **Risk Level**: Medium ### Vulnerable Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The same dependency is later automatically upgraded to the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` The package is also declared without a fixed version in the Skill metadata: ```yaml metadata: {"openclaw":{"emoji":"🔄","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning an audited version. It additionally directs the Agent to upgrade to `@latest` under several routine conditions. Consequently, the code that executes can change after this Skill has been reviewed. npm package installation can execute package lifecycle scripts, while the installed `qhkit` binary subsequently runs with the privileges of the Agent's operating-system account. A compromised package release, maintainer account, registry response, or configured package mirror could therefore introduce arbitrary code. The global `-g` installation also exceeds the minimum scope required for the declared image-generation task. A project-local, version-pinned installation would reduce both the affected filesystem scope and the possibility of changing a shared command used by other workflows. The separately flagged command at `SKILL.md:49` is not a `curl | bash` execution pipeline. It pipes a checksum manifest through `grep` into `sha256sum -c`, and the downloaded Node.js archive is only extracted after verification. That command does not constitute remote script execution. ### Attack Path 1. An attacker compromises the npm maintainer account, package publication process, registry, or permitted mirror for `@iqinghu/qhkit`. 2. The attacker publishes a maliciou ...[truncated 1310 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed: ```bash npm install --save-exact @iqinghu/qhkit@<audited-version> ``` 2. Use a project-local installation rather than `npm -g`, and invoke the pinned binary through a controlled project script or its explicit local path. 3. Commit a lockfile and verify its integrity metadata so dependency resolution is reproducible. 4. Remove automatic `@latest` upgrades. Treat upgrades as an explicit review event, verify release provenance and changes, and update the pinned version only after approval. 5. Disable npm lifecycle scripts with `--ignore-scripts` when the package can function without them. If lifecycle scripts are required, review them before installation and execute installation in a restricted environment. 6. Prefer the official npm registry. If a mirror is necessary, document its trust assumptions and retain package integrity verification rather than treating the mirror as interchangeable without validation. 7. Run installation and CLI execution in a sandbox or dedicated low-privilege account with limited filesystem, credential, and network access. 8. Avoid exposing unrelated secrets to the CLI process. Supply the LinkPix token only when required and use a narrowly scoped, revocable credential where supported. ]]>