T08 · Insecure Dependencies
Error
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party Packages Are Installed and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 47-88 **Vulnerability Type**: Supply-chain exposure through unpinned executable dependencies **Risk Level**: High ### Evidence ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple ``` ```bash npx --yes sharp-cli -i original-image -o compressed-image.jpg resize 2048 ``` The instructions also permit npm installation through an alternate registry: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install or execute third-party packages without pinning reviewed versions or verifying package integrity. In particular, `@latest` deliberately resolves to mutable code published after the Skill was audited, while `npx --yes` downloads and executes a package without an interactive confirmation step. Global npm installation increases the impact because the installed binary remains available outside the current task and may replace an existing command with the same name. npm installation can also execute package lifecycle scripts. A compromised publisher account, malicious future release, dependency confusion event, or compromised registry mirror could therefore cause arbitrary code execution under the Agent's operating-system account. The Node.js bootstrap command separately identified by the pre-scan is not itself a `curl | bash` operation. It downloads a binary archive and verifies it using the official SHA-256 manifest before extraction. That checksum process is materially safer than direct remote-script execution. However, it does not mitigate the unpinned npm, pip, and npx dependency risks described here. ### Attack Path 1. An attacker compromises a package publisher, upstream dependency, package release, or configured registry mirror. 2. The attacker publishes a malicious version under one ...[truncated 1392 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every executable dependency to a reviewed exact version; do not use `@latest`. 2. Record and verify package integrity hashes or use a lockfile with integrity metadata. 3. Install dependencies in a dedicated, non-global project directory or disposable container. 4. Replace `npx --yes sharp-cli` with a locally installed, pinned dependency. 5. Require explicit user approval before installing or upgrading executable software. 6. Disable unnecessary npm lifecycle scripts where compatible, for example by using `--ignore-scripts`. 7. Prefer the canonical package registries. If mirrors are necessary, document their trust implications and verify fetched artifacts against independently obtained integrity values. 8. Run media-processing and API tools under a restricted account with access only to explicitly selected input and output files. 9. Avoid automatic upgrades in response to server or stderr messages. Present the exact proposed version and obtain approval before installing it.