T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:40
- Finding
- Automatic Installation and Execution of Unpinned Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 40-47 and 67-71; dependency metadata is also declared near line 8 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🎉","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` The documented fallback executes the package through `npx` without a pinned version: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade instructions explicitly install the latest available package: ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit use of an alternative registry: ```bash npm i -g @iqinghu/qhkit --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill automatically installs and executes `@iqinghu/qhkit` without pinning it to a reviewed, immutable version or validating package integrity against a trusted hash. The `@latest` upgrade command deliberately resolves to mutable remote content, while the `npx` fallback may download and execute a currently published package on demand. npm packages can execute JavaScript and package lifecycle scripts with the permissions of the invoking user. Therefore, the effective executable behavior can change after the Skill itself has been reviewed. A compromised package release, maintainer account, registry response, or configured mirror could introduce arbitrary code without requiring any modification to `SKILL.md`. Using a global installation increases exposure by making the tool available beyond the immediate task and potentially replacing an existing command on the user's executable search path. The alternative npm mirror introduces an additional supply-chain trust boundary. No evidence shows that the named package or mirror is currently malicious; the vulnerability is the absence of version and integrity co ...[truncated 2142 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than using an implicit current version or `@latest`: ```bash npm install --global @iqinghu/qhkit@<reviewed-version> ``` 2. Record and verify the package integrity value obtained from a trusted source. Prefer a lockfile using npm's integrity metadata where the deployment model permits it. 3. Remove automatic upgrades to `@latest`. Require a separate review and explicit user approval before changing the installed version. 4. Avoid `npx` for unpinned on-demand execution. If it must be supported, specify the exact reviewed package version and disable unnecessary installation behavior. 5. Prefer a project-local, isolated dependency installation over a global installation. Execute the reviewed local binary directly so it cannot unexpectedly replace or shadow unrelated system tools. 6. Require explicit user confirmation before installing any package or changing the environment. 7. Use the official npm registry by default. If a mirror is necessary, document its trust implications and retain integrity verification anchored to information obtained independently of that mirror. 8. Run the CLI in a restricted environment with only the files, network destinations, and environment variables required for image generation. Provide the API token only to the specific process that needs it. 9. Document the precise data transmitted by the CLI, including prompts, local product images, authentication tokens, and resulting service metadata, so users can make an informed decision before execution. ]]>