T08 · Insecure Dependencies
Error
- Location
- SKILL.md:51
- Finding
- Unpinned Third-Party Packages Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 51–90 **Vulnerability Type**: Supply-chain exposure through mutable third-party dependencies **Risk Level**: High ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```text pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i 原图 -o 压缩后.jpg resize 2048 ``` The instructions also permit npm installation through an alternate registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute dependencies without pinning exact versions or verifying package integrity. In particular: - `@iqinghu/qhkit` is installed without a version at line 51. - The upgrade instruction explicitly installs the mutable `@latest` release at line 77. - Pillow is installed without a fixed version and through a third-party Python package mirror. - `npx --yes sharp-cli` automatically downloads and executes the currently resolved package without interactive confirmation. - Global npm installation modifies the user's executable environment rather than using an isolated, task-specific environment. The effective code executed by these commands can change after the Skill has been reviewed. A compromised maintainer account, package release, registry, mirror, or dependency can therefore introduce arbitrary code into the Agent environment. The dependencies are relevant to the declared video-generation and image-resizing functionality, but automatic, unpinned installation exceeds the minimum safe dependency-management behavior. Image resizing could instead use an already installed tool or an isolated, pinned dependency. The primary CLI should likewise be installed at a reviewed version. ### Attack Path 1. An attacker compromises a package maintainer account, package registry, mirror, or transitive dependency. 2. The attacker publishes a malicious version ...[truncated 1225 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version, including `@iqinghu/qhkit`, Pillow, and `sharp-cli`. 2. Remove `@latest` and avoid unversioned `npx --yes` execution. 3. Verify downloaded packages using lockfiles, npm integrity metadata, hashes, or signed provenance. 4. Prefer project-local installation in an isolated directory or container instead of global npm installation. 5. Require explicit user approval before installing or upgrading executable dependencies. 6. Use the official package registry by default. If mirrors are permitted, document their trust model and apply the same integrity verification. 7. Disable or review npm lifecycle scripts where feasible. 8. Prefer already installed image-processing tools. If installation is unavoidable, use an isolated virtual environment and a pinned, hash-verified requirements file. 9. Define a reviewed minimum and maximum supported CLI version rather than automatically following the newest release. ]]>