T08 · Insecure Dependencies
Error
- Location
- SKILL.md:52
- Finding
- Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 52–91 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` The same section also directs the agent to invoke `sharp-cli` through an unpinned, automatically approved `npx --yes` installation. ### Technical Analysis The Skill directs the agent to download and execute mutable third-party packages without pinning exact versions or verifying package integrity. The explicit use of `@latest` guarantees that future executions may run code that was not available during this audit. The unversioned npm, pip, and `npx` operations have the same underlying problem. npm packages can execute lifecycle scripts during installation. Packages invoked through `npx` are downloaded and executed, while Python packages can run build or installation logic. Consequently, compromise of a package publisher, dependency, package release, or configured registry can turn a routine Skill invocation into arbitrary local code execution. The use of npm mirrors and a separately configured Python mirror expands the supply-chain trust boundary. Unlike the Node.js archive installation described elsewhere in the file, these package installation commands do not perform an independent hash or signature check. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, its publisher account, or a configured package registry. 2. The attacker publishes a malicious release under the expected package name. 3. The Skill encounters a missing dependency, an upgrade condition, or an oversized image requiring a conversion utility. 4. The agent follows the documented unpinned `npm`, `pip`, or `npx` command. 5. The package manager downloads the attacker-controlled release. 6. Installation lifecycle code, ...[truncated 945 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version rather than using unversioned packages or `@latest`. 2. Maintain a lockfile or an internal manifest containing expected package versions and integrity hashes. 3. Verify downloaded artifacts against independently maintained checksums or trusted signatures before execution. 4. Replace `npx --yes` with a preinstalled, pinned utility or a locally reviewed tool included in a controlled runtime image. 5. Use a trusted internal registry or explicitly approved official registry, and document the registry trust model. 6. Disable npm lifecycle scripts where the package does not require them, for example by using `--ignore-scripts` after compatibility testing. 7. Run dependency installation and media processing in a sandbox with restricted filesystem access, no unnecessary credentials, and limited outbound network access. 8. Require explicit user approval before installing or upgrading software. 9. Do not recommend privilege elevation as a routine response to installation failures; prefer a user-scoped installation. 10. Continuously scan pinned packages and transitive dependencies for known vulnerabilities and publisher or ownership changes. ]]>