T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:47
- Finding
- Unpinned Third-Party Packages Are Installed and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47`, `SKILL.md:70-74`, and `SKILL.md:86` **Vulnerability Type**: Supply-chain exposure through unpinned package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```bash pip install pillow -i https://pypi.tuna.tsinghua.edu.cn/simple npx --yes sharp-cli -i <input-image> -o <output-image>.jpg resize 2048 ``` The instructions also permit npm mirror fallback through: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the agent to install and execute third-party packages without pinning exact versions or verifying package integrity. In particular, `@latest` deliberately resolves to mutable package content, while `npx` can download and immediately execute a package that was not present during the Skill audit. npm packages can run executable entry points and installation lifecycle scripts with the permissions of the invoking account. Python packages installed with `pip` can similarly execute build or installation logic. Consequently, the reviewed `SKILL.md` does not fully determine the code that will execute when the Skill is invoked. The use of third-party mirrors introduces additional registry trust. Although these mirrors may be legitimate availability fallbacks, the Skill provides no package hash, lockfile, signature, or provenance verification that would detect malicious or unexpectedly modified artifacts. Global installation exceeds the minimum access needed for an isolated video-generation operation because it changes the user's shared runtime environment rather than a Skill-specific environment. ### Attack Path 1. An attacker compromises a permitted package publisher account, package release, or registry/mirror delivery path. 2. The attacker publishes malicious package content under a version selected by an unpinn ...[truncated 1134 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed exact version rather than using an implicit current release or `@latest`. 2. Commit and enforce a lockfile containing registry-resolved integrity values. 3. Verify package signatures, checksums, or trusted provenance attestations before installation. 4. Remove automatic upgrade instructions. Require explicit user approval and a separate review before changing versions. 5. Install dependencies in a Skill-specific, non-privileged environment rather than globally. 6. Avoid `npx` for implicit download-and-execute behavior. Install a pinned package first, verify it, and then invoke its local binary. 7. Pin Pillow and Sharp tooling to reviewed versions and use isolated Python virtual environments or local npm projects. 8. Prefer the primary package registry. If a mirror is required, document its trust model and verify downloaded artifacts against integrity data obtained through an independent trusted channel. 9. Run third-party media-processing and generation tools in a sandbox with restricted filesystem and network access. ]]>