T08 · Insecure Dependencies
Error
- Location
- SKILL.md:50
- Finding
- Unpinned Third-Party Packages Are Installed and Executed at Runtime## Vulnerability Details **File Location**: `SKILL.md:50-57`, `SKILL.md:77-83`, and `SKILL.md:93` **Vulnerability Type**: Supply-chain exposure through mutable third-party dependencies **Risk Level**: High ### Vulnerable Code ```bash 2. **No qhkit but node/npm is available** → Global installation: npm i -g @iqinghu/qhkit **Upgrade**: npm i -g @iqinghu/qhkit@latest ``` The image-compression fallback also installs or executes unpinned packages: ```bash python -c "from PIL import Image, ImageOps; im=ImageOps.exif_transpose(Image.open('original')); im.thumbnail((2048,2048)); im.convert('RGB').save('compressed.jpg', quality=85)" # If Pillow is missing: pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple # If Python is unavailable: npx --yes sharp-cli -i original -o compressed.jpg resize 2048 ``` ### Technical Analysis The Skill instructs the Agent to install or execute mutable third-party packages during task execution. No exact package versions, lockfile, integrity hashes, or reviewed artifact digests are specified. `npm i -g` also installs the CLI globally for the current user or system, depending on the npm configuration. This creates a broader and longer-lived change than a task-scoped installation. The explicit use of `@latest` makes the executed package dependent on whichever release is current when the Skill runs. The Pillow and `sharp-cli` fallback paths have the same issue. `npx --yes` can download and immediately execute a package without an interactive confirmation. Alternate npm and Python package mirrors add additional supply-chain trust boundaries. This finding concerns package-manager execution, not the checksum command at line 63. The following flagged command does not pipe a script into a shell: ```bash curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` It sends checksum metadata to `grep` a ...[truncated 1679 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version; do not use `@latest` or unconstrained package names. 2. Record and verify package integrity hashes or use a lockfile with integrity metadata. 3. Avoid global npm installation. Use a dedicated, non-privileged, task-scoped directory or isolated container. 4. Require explicit user approval before installing or upgrading executable dependencies. 5. Prefer a preinstalled, reviewed `qhkit` release rather than downloading code during Skill execution. 6. Pin Pillow and `sharp-cli` versions and validate their artifacts before execution. 7. Avoid `npx --yes` for packages that have not already been reviewed and cached. 8. Use a single trusted registry where possible. If mirrors are necessary, document their trust model and verify package integrity independently of the mirror. 9. Disable unnecessary package lifecycle scripts where compatible, for example by using npm's `--ignore-scripts` option after confirming the package does not legitimately require them. 10. Run image conversion and external CLIs in a sandbox with restricted filesystem, credential, and network access.