T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned Third-Party CLI Installation and Automatic Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 43–76 **Vulnerability Type**: Third-party supply-chain exposure through mutable npm dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit [command] ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit switching npm downloads to the third-party mirror `https://registry.npmmirror.com`. ### Technical Analysis The Skill instructs the agent to download and execute `@iqinghu/qhkit` without pinning an exact, reviewed version or independently verifying package integrity. The `@latest` upgrade command explicitly permits future package releases to be installed without review. The `npx` fallback can fetch and immediately execute the package. npm installation can execute package lifecycle scripts under the invoking user's account. A compromised publisher account, package release, registry, or configured mirror could therefore turn the installation step into arbitrary local code execution. Global installation increases exposure by placing executable content in a shared user or system-level npm location and is broader than necessary for a single Skill invocation. Installing a CLI is related to the declared image-generation functionality, but mutable global installation and automatic upgrades exceed the minimum necessary privilege and trust scope. A project-local, version-pinned, integrity-locked installation would provide the required functionality with less risk. The separately flagged checksum pipeline is not a `curl | bash` execution path: ```bash curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` It passes downloaded checksum data to `sha256sum`, not to a shell. However, obtaining both the Node.js archive and checksum file from the same fallback mirror does not protect against compromise of tha ...[truncated 1481 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than using an unversioned package reference or `@latest`. 2. Commit a lockfile containing npm integrity metadata and use a deterministic installation method such as `npm ci`. 3. Install the dependency in an isolated project directory rather than globally. 4. Do not use automatic `npx` retrieval for uninstalled packages. Configure it to avoid installation or invoke only a previously verified local binary. 5. Remove automatic upgrade instructions. Require explicit user approval and a security review before changing dependency versions. 6. Verify the package tarball against a trusted, independently distributed digest or signed provenance before execution. 7. Avoid third-party registry mirrors where possible. If a mirror is required, document its trust implications and enforce integrity verification. 8. Run the CLI in a sandbox with restricted filesystem, environment-variable, and network access. Expose only the input images and token needed for the current operation. 9. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup operations. 10. Keep API tokens out of command history and scope them to the minimum permissions and lifetime supported by the service.