T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:80
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 7 and 80–86; upgrade instruction at lines 111–115 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: { "openclaw": { "emoji": "🚪", "requires": { "bins": ["qhkit"] }, "install": [ { "kind": "node", "package": "@iqinghu/qhkit", "bins": ["qhkit"] } ] } } ``` ```bash npm i -g @iqinghu/qhkit ``` The documented fallback also invokes the unpinned package through `npx`: ```bash npx @iqinghu/qhkit <command> ... ``` The upgrade instructions explicitly install the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute the third-party npm package `@iqinghu/qhkit` without pinning it to a reviewed version or verifying package integrity. The `@latest` upgrade instruction is explicitly mutable, while the unversioned `npm` and `npx` forms ordinarily resolve according to current registry metadata. npm installation may execute package lifecycle scripts, and subsequent workflow commands execute package runtime code with the privileges of the invoking user. A global installation also changes the user's environment beyond the immediate project. The documented fallback registry introduces an additional dependency-distribution path, although the audit found no evidence that the named mirror is itself malicious. The CLI is necessary for the Skill's declared video-generation workflow. However, installing an unpinned release globally or executing it dynamically through `npx` exceeds the safest minimum necessary. A locally installed, version-pinned, integrity-verified dependency would reduce exposure. This finding does not establish that the current package is malicious. It identifies a supply-chain weakness that would allow the effective executable code to change afte ...[truncated 1618 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version in both metadata and command examples: ```bash npm install --save-exact @iqinghu/qhkit@<reviewed-version> ``` 2. Record and verify the package's expected registry integrity value or cryptographic digest before executing it. 3. Remove automatic `@latest` upgrades. Require explicit user approval and security review before changing the installed version. 4. Prefer a project-local installation over a global installation, and invoke the pinned local binary. This limits changes to the user's broader command environment. 5. Avoid an unpinned `npx` fallback. If `npx` is required, specify the exact reviewed version and prevent implicit replacement by a newer release. 6. Where package compatibility permits, install with lifecycle scripts disabled: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@<reviewed-version> ``` If lifecycle scripts are required, review them and document why they are necessary. 7. Use the official npm registry by default. If a mirror must be used, treat it as a separate trust boundary and verify that the retrieved package has the same expected integrity value. 8. Run the CLI in a restricted environment with access only to required media files, network destinations, and the minimum necessary token. 9. Keep tokens out of command history and process arguments where possible. Prefer a narrowly scoped environment variable or protected configuration file with restrictive permissions.