T08 · Insecure Dependencies
Error
- Location
- SKILL.md:77
- Finding
- Unpinned Third-Party npm Package Is Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 6, 77–80, and 108 **Vulnerability Type**: Unpinned executable dependency and mutable package upgrade **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"👥","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit execution through `npx` without specifying an immutable version: ```bash npx @iqinghu/qhkit <command> ... ``` ### Technical Analysis The Skill instructs the agent to install and execute `@iqinghu/qhkit` without pinning an audited, immutable package version or verifying the npm package integrity hash. The upgrade procedure explicitly installs the mutable `latest` release. npm packages can execute lifecycle scripts during installation with the privileges of the installing user. A newly published, compromised, or malicious package version could therefore run arbitrary local code before the CLI is invoked. A global installation also expands the change beyond the immediate task by placing the executable in a shared command location. The optional npm mirror introduces an additional distribution path whose responses and availability are outside the project itself. No evidence establishes that the named package is currently malicious; the vulnerability is the trust placed in mutable remote dependency content without version or integrity controls. The separately flagged Node.js download pipeline is not a `curl | bash` execution path. It downloads a fixed archive and verifies it against `SHASUMS256.txt` before extraction. Consequently, that pipeline is not classified as a confirmed remote shell-payload vulnerability. ### Attack Path 1. An attacker compromises the npm package maintainer account, the package publication process, or a configured registry distribution path. 2. The attacker publishes a ...[truncated 1626 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specifically reviewed version in both Skill metadata and installation commands, for example: ```bash npm install --global @iqinghu/qhkit@0.10.0 ``` Do not use `@latest` in automated instructions. 2. Record and verify the expected npm package integrity value or install from a lockfile using a reproducible installation method such as `npm ci`. 3. Prefer a project-local installation over a global installation: ```bash npm install --save-exact @iqinghu/qhkit@0.10.0 ``` Invoke the pinned local binary rather than modifying a shared global command location. 4. Avoid unpinned `npx` execution. If `npx` is unavoidable, provide the exact reviewed version and prevent implicit substitution with unrelated installed packages. 5. Review package lifecycle scripts before installation. Where compatible with the package, install with `--ignore-scripts`; otherwise, execute installation in a sandbox with restricted filesystem, network, and credential access. 6. Retain the existing least-privilege approach that avoids root installation. Do not recommend privilege elevation merely to make global npm installation succeed. 7. Restrict the CLI's runtime access to only the user-selected media files and required service endpoints. Supply the API token only to the workflow process, and avoid leaving it in shell history or broadly readable configuration files. 8. Document the expected package publisher, registry, version, integrity digest, service domains, and data-upload behavior so operators can detect unexpected supply-chain changes. 9. Treat mirror use as a controlled fallback. Require the same pinned version and integrity verification regardless of the selected registry.