T08 · Insecure Dependencies
Error
- Location
- SKILL.md:38
- Finding
- Unpinned Third-Party CLI Installation and Automatic Upgrade## Vulnerability Details **File Location**: `SKILL.md:38-44` and `SKILL.md:64-68` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit installation through an alternative registry: ```bash npm i -g @iqinghu/qhkit --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute the third-party `@iqinghu/qhkit` npm package without pinning an audited version or package integrity value. It also explicitly instructs the Agent to install `@latest` in several error or update scenarios. Consequently, the effective executable code can change after this Skill has been reviewed. An npm package installation may execute lifecycle scripts, while subsequent `qhkit` or `npx` invocations execute package-controlled code. Global installation increases exposure by placing the executable into the Agent user's shared command environment. The alternative registry is presented as a network fallback. Although this is not evidence that the mirror is malicious, using another supply-chain source increases the number of systems whose integrity must be trusted. No lockfile, integrity hash, package signature, reviewed artifact, or sandboxing requirement is specified. The Node checksum pipeline elsewhere in the file is not a `curl | bash` execution pattern: ```bash curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` It passes downloaded checksum data to `grep` and `sha256sum`, not to a shell interpreter, and the instructions require successful verification before extraction. Therefore, that pipeline is not classified as a confirmed remote shell payload vulnerability. ### Attack Path 1. An attacker compromises the npm package, its maintainer accou ...[truncated 1675 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version instead of using an unconstrained package or `@latest`. 2. Record and verify the expected npm package integrity digest before installation. 3. Remove automatic upgrade instructions. Require a separate review before changing the pinned version. 4. Prefer a project-local installation with a committed lockfile over global installation. 5. Avoid `npx` behavior that implicitly downloads an unresolved current package version. If `npx` is necessary, specify the exact audited version. 6. Run the CLI in a sandbox or container with restricted filesystem, credential, and network access. 7. Disable npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@AUDITED_VERSION ``` If lifecycle scripts are required, review those scripts before allowing execution. 8. Use the official registry as the default trusted source. If a mirror is required, independently verify package integrity against a trusted digest rather than trusting artifact and verification metadata from the same source. 9. Provide the API token only to the individual CLI invocation that needs it, and prevent unrelated installation scripts from inheriting the token. 10. Inform users before local images or videos are uploaded to the external service, particularly when material may be confidential.