T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:39
- Finding
- Unpinned Global Installation of a Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, lines 39 and 68 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code At line 39: ```bash npm i -g @iqinghu/qhkit ``` At line 68: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The skill instructs the agent to install `@iqinghu/qhkit` globally without pinning it to an audited version. The upgrade procedure explicitly selects the mutable `latest` release. Consequently, the code installed and executed can change after this skill has been reviewed. An npm installation may execute package lifecycle scripts, including installation hooks. If the package, a transitive dependency, its publisher account, the npm registry path, or the recommended fallback mirror is compromised, arbitrary code could run during installation. A global installation also places executable files in a shared command location and affects future sessions, exceeding the minimum scope needed for a single image-generation task. The document avoids requiring root and offers `npx` after permission failure, which limits system-wide privilege escalation, but the default remains a persistent account-wide installation. The dependency is consistent with the skill's declared functionality and is not shown to be malicious. The vulnerability is the mutable, globally installed supply-chain dependency rather than evidence of intentional malicious behavior. The separately flagged checksum command is not a `curl | bash` execution: ```bash cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` It pipes a checksum manifest through filtering and verification, not into a shell interpreter. The accompanying instructions require successful verification before extraction, so that command is not treated as a confirmed vulnerability. ### Attack P ...[truncated 1396 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version rather than resolving the mutable latest release: ```bash npm install --prefix "$HOME/.local/qhkit" @iqinghu/qhkit@REVIEWED_VERSION ``` 2. Prefer a project-local or dedicated user-local installation over `npm -g`, and invoke the exact installed binary. This limits changes to shared command paths and simplifies removal. 3. Record and verify the package archive's expected integrity hash or signature through a trusted, independently maintained manifest. 4. Audit the selected release, its transitive dependency tree, and all npm lifecycle scripts before allowing installation. 5. Use `--ignore-scripts` when the reviewed package can operate without lifecycle scripts. If scripts are required, document and validate each required script rather than enabling all hooks implicitly. 6. Replace automatic `@latest` upgrades with an explicit version allowlist. Review and approve a new version before changing the pinned value. 7. Do not execute upgrade commands supplied dynamically in remote error messages without validating them against the allowlist. 8. Avoid silently switching registries. If a mirror is required, treat it as an additional trust boundary and verify downloaded package integrity against independently trusted metadata. 9. Run installation and image generation in a restricted account or sandbox with access only to required input and output files. Do not expose unrelated credentials or directories. 10. Never recommend elevated installation as a workaround for global-install permission failures.