T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Third-Party CLI Installation and Automatic Upgrade## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:39-43`, and `SKILL.md:58-62` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🌍","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` The surrounding instructions also permit unpinned execution through: ```bash npx @iqinghu/qhkit ``` The upgrade procedure explicitly retrieves the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without specifying an audited version or verifying the integrity of the package artifact. It also instructs the Agent to install `@latest` in response to version-related messages. Consequently, the code executed at installation time and during later CLI operations can change after this Skill has been reviewed. npm installation may execute package lifecycle scripts, while subsequent `qhkit` or `npx` calls execute package-controlled application code. None of that executable code is present in this project, so its behavior cannot be verified by auditing `SKILL.md`. A global installation additionally gives the package persistence and reach across the user's environment beyond what a task-local dependency requires. The Node.js bootstrap pipeline at `SKILL.md:48-49` is not a `curl | bash` execution pattern. It downloads a versioned archive and validates it with an HTTPS-retrieved SHA-256 manifest before extraction. The confirmed issue is instead the mutable npm dependency installed after Node.js is available. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, upstream repository, or permitted package mirror for `@iqinghu/qhkit`. 2. The attacker publishes a malicious release under the same package name. 3. T ...[truncated 1721 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version in both metadata and all installation commands. Do not use an unqualified package name or the `@latest` tag. 2. Record and verify the expected package integrity hash. Use a lockfile committed after review or retrieve a fixed package artifact and compare it against a separately maintained SHA-512 or SHA-256 value. 3. Replace global installation with a task-local installation in an isolated working directory or container. Execute the pinned local binary rather than placing it in the user's global npm prefix. 4. Avoid automatic upgrades based solely on output produced by the installed CLI. Treat upgrade messages as untrusted input and require explicit review of the proposed version, release notes, provenance, and integrity before installation. 5. Disable npm lifecycle scripts with `--ignore-scripts` when the package can operate without them. If scripts are required, review those scripts for the exact pinned release before allowing execution. 6. Use only the official npm registry unless a mirror is explicitly trusted. If fallback mirrors remain supported, require the same pinned version and independently verified integrity value on every source. 7. Run the CLI with minimal filesystem and environment access. Provide the API token only for the required invocation, restrict access to the selected input video and output directory, and block unnecessary outbound destinations. 8. Document a controlled upgrade process that tests new releases in a sandbox before changing the pinned production version.