T08 · Insecure Dependencies
Error
- Location
- SKILL.md:44
- Finding
- Unpinned third-party CLI installation and execution## Vulnerability Details **File Location**: `SKILL.md`, lines 44–47 and 73 **Vulnerability Type**: Unpinned and globally installed third-party dependency **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the agent to install or execute `@iqinghu/qhkit` without pinning an audited version or verifying package integrity. The explicit `@latest` upgrade instruction also allows the executed implementation to change after the Skill has been reviewed. npm packages can execute lifecycle scripts during installation. The installed CLI subsequently processes API credentials and user-selected local media. A compromised package release, publisher account, registry, mirror, or transitive dependency could therefore introduce arbitrary executable code. Global installation is broader than necessary for invoking this CLI. Although it does not inherently grant administrator privileges, it modifies the agent user's shared executable environment and can affect other sessions using the same account. If the installation is performed through an elevated npm configuration, the package may execute with those elevated privileges. ### Attack Path 1. An attacker compromises the package publisher, package registry, configured mirror, or a transitive dependency. 2. The attacker publishes a malicious version under the legitimate package name. 3. The agent follows the Skill and runs an unpinned global installation, `npx`, or the `@latest` upgrade. 4. Malicious lifecycle code or CLI code executes with the privileges of the agent process. 5. The malicious package can access files readable by that account, including selected media and locally available credentials, and can modify the user's environment or communicate over the network. ### Impact Assessment Successful exploitatio ...[truncated 707 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than resolving an unconstrained version or `@latest`. 2. Record and verify the expected package integrity value through a lockfile or another trusted integrity mechanism. 3. Prefer a project-local or isolated installation over a global installation. 4. Avoid automatic upgrades. Review release provenance, changes, and integrity before changing the pinned version. 5. Where compatible with the package, disable npm lifecycle scripts during installation and explicitly enable only scripts proven necessary. 6. Do not recommend privilege elevation for installation. If installation cannot proceed with ordinary user privileges, stop and request an explicit user decision. 7. Restrict the CLI process to the minimum required files, environment variables, and network destinations. 8. Treat alternative registries as additional supply-chain trust boundaries and use only explicitly approved sources.