T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:65
- Finding
- Execution of Upgrade Commands Supplied Through Remote CLI Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65-66 **Vulnerability Type**: Remote payload retrieval and execution through trusted response content **Risk Level**: High ### Relevant Snippet The relevant instruction, translated into English, states: > If the command returns `{"ok":false,"stage":"version",...}`, the message contains the upgrade command; execute it as provided. ### Technical Analysis The Skill instructs the Agent to execute an upgrade command obtained from the `message` field of a `qhkit` response. Although the document later presents a fixed npm upgrade command, the instruction to execute response-supplied commands “as provided” does not constrain execution to that fixed command. Response text from a remotely connected CLI must be treated as untrusted data rather than executable instructions. The effective command can change after the Skill has been reviewed if the remote service, npm package, update infrastructure, or CLI response-processing path is compromised. This creates a remote command-execution channel under the Agent's local user identity. It exceeds the minimum privileges required to detect an outdated CLI and inform the user or run a hard-coded, validated upgrade operation. ### Attack Path 1. An attacker compromises the Qinghu service, the installed `qhkit` package, its update mechanism, or another component controlling CLI responses. 2. The compromised component returns a version-stage failure containing an attacker-selected shell command in its `message` field. 3. The Agent follows the Skill instruction to execute the command as provided. 4. The command runs with the permissions and environment of the Agent process. 5. The payload can access files, environment variables, configured API tokens, and other resources available to that account. ### Impact Assessment Successful exploitation permits arbitrary command execution with the Agent's current operating-system privileges. Potential consequences in ...[truncated 565 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the instruction to execute commands contained in a CLI response. - Treat every response `message` field as display-only, untrusted data. - Permit upgrades only through a hard-coded command with an explicit argument allowlist, for example: ```bash npm install --global @iqinghu/qhkit@<approved-version> ``` - Pin the upgrade to an audited version rather than accepting an arbitrary version or command from the service. - Reject response text containing shell operators, substitutions, redirections, additional commands, URLs, or unexpected arguments. - Require explicit user confirmation before installing or upgrading local software. - Run installation in a restricted environment without unrelated credentials or sensitive project access. - Verify package provenance and integrity before execution. ]]>