T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:54
- Finding
- Unpinned Third-Party CLI Installation Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:54-58`, `SKILL.md:81-85`, and `SKILL.md:96` **Vulnerability Type**: Unpinned executable dependencies **Risk Level**: Medium ### Relevant Code ```yaml metadata: {"openclaw":{"emoji":"🛍️","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` Additional fallback instructions install or execute unpinned image-processing dependencies: ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to install executable third-party packages without fixed versions or integrity constraints. The installation metadata also names `@iqinghu/qhkit` without a version. Consequently, the actual code executed can change after the Skill has been reviewed. The explicit `@latest` upgrade instruction increases this risk by automatically selecting the newest package release rather than a reviewed version. The `Pillow` and `sharp-cli` fallback dependencies are also unpinned. Alternative registries and mirrors expand the set of delivery infrastructure that must remain trustworthy. Package installation can execute package lifecycle logic and subsequently runs the installed CLI. The `qhkit` CLI is expected to handle an API token, read local product images, and upload those images to a remote service. A compromised package release, package-maintainer account, registry, mirror, or dependency in the transitive dependency graph could therefore turn the documented installation process into arbitrary local code execution. The Node.js archive download at `SKILL.md:62-66` is not a `curl | bash` operation. The downloaded archive is checked using `sha256sum -c` before extraction. That sequence does not constitute direct shell execut ...[truncated 2087 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific reviewed version in both the installation metadata and all command examples. 2. Replace `@latest` upgrades with an explicitly approved version and require a review before changing that version. 3. Use npm lockfiles or published integrity values where supported, and verify package integrity before execution. 4. Pin the versions of `Pillow` and `sharp-cli`; avoid ad hoc installation of mutable package references during Skill execution. 5. Prefer dependencies that are preinstalled in a controlled runtime image. If dynamic installation is unavoidable, use an allowlisted registry and restrict or disable package lifecycle scripts where compatible. 6. Treat mirrors only as explicitly approved alternatives. Document their trust assumptions and ensure transport security and artifact integrity checks remain enabled. 7. Run third-party tools in a sandbox with access only to the required input and output files. Do not expose unrelated home-directory or project files. 8. Pass the API token only to the process that requires it, avoid placing it in command history, and use a narrowly scoped, revocable token where the service supports that model. 9. For the Node.js bootstrap, pin the expected archive checksum in the reviewed Skill or verify a cryptographic release signature through an independently trusted key instead of relying exclusively on a checksum manifest retrieved from the same delivery source.