T08 · Insecure Dependencies
Error
- Location
- SKILL.md:54
- Finding
- Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:52-57`, `SKILL.md:78-80`, and `SKILL.md:93` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies and mutable package versions **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i SOURCE_IMAGE -o COMPRESSED_IMAGE.jpg resize 2048 ``` The instructions also permit npm mirror use: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute third-party packages without pinning exact versions or verifying package integrity. The core `@iqinghu/qhkit` dependency is initially installed without a version, while its upgrade procedure explicitly selects the mutable `latest` release. The fallback image-compression workflow similarly installs an unpinned Python package or executes an unpinned npm package through `npx --yes`. Package installation and `npx` execution can run package-controlled installation hooks and executable code. Consequently, the effective code executed by the Skill may change after the Skill itself has been reviewed. Use of third-party registry mirrors introduces additional infrastructure and synchronization trust boundaries. Global npm installation also changes the user's persistent tool environment rather than limiting the dependency to an isolated directory. This exceeds the minimum privilege and persistence footprint necessary to invoke an image-generation client, because a version-pinned, local, isolated installation would be sufficient. ### Attack Path 1. An attacker compromises a maintainer account, package release pipeline, registry, or configured mirror for one of the referenced packages. 2. The attacker publishes a malicious release under the expected package name or causes a mirror to distribute modified package content. 3. ...[truncated 1351 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version, for example: ```bash npm install --save-exact @iqinghu/qhkit@REVIEWED_VERSION python -m pip install pillow==REVIEWED_VERSION npx --yes sharp-cli@REVIEWED_VERSION ... ``` 2. Remove the instruction to install `@latest`. Require a Skill update and security review before changing dependency versions. 3. Use a lockfile with integrity metadata and require deterministic installation through `npm ci`. 4. Prefer a project-local installation or isolated temporary environment over `npm install -g`. 5. Verify package artifacts against publisher-provided cryptographic hashes or signatures before execution. 6. Restrict automatic package installation. If a dependency is absent, disclose the proposed package, version, source, and scope, then obtain user approval. 7. Avoid registry mirrors unless explicitly trusted by the user. If a mirror is necessary, apply the same integrity verification as for the primary registry. 8. Package reviewed image-compression functionality with the Skill or use an already installed system tool rather than dynamically executing an unpinned package. 9. Run dependency tooling in a sandbox with restricted filesystem access, a minimal environment, and network access limited to required endpoints. ]]>