T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:41
- Finding
- Unpinned Third-Party CLI Installation and Automatic Upgrade<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41-44 and line 62 **Vulnerability Type**: Unpinned and mutable third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit execution through `npx` without specifying an exact package version. ### Technical Analysis The Skill instructs the agent to install and execute `@iqinghu/qhkit` without pinning an audited version or integrity digest. It additionally directs automatic installation of the mutable `latest` release when certain errors or notices occur. An npm installation may execute package lifecycle scripts, while subsequent CLI invocation executes the installed package with the permissions of the invoking user. Because the resolved package contents can change after this Skill has been audited, the effective executable code is not bounded by the reviewed repository. The global installation is broader than necessary for the declared image-generation functionality. A project-local, version-pinned, isolated installation would provide the required command without modifying the user's global npm environment. The optional registry mirror adds another supply-chain trust dependency, although the audit found no evidence that the named package or mirror is currently malicious. ### Attack Path 1. An attacker compromises the npm package maintainer account, publication pipeline, package registry response, or approved mirror. 2. The attacker publishes a malicious version under the legitimate package name and makes it the currently resolved or `latest` version. 3. The Skill encounters a missing dependency, version-gate response, update notice, or applicable catalog notice. 4. Following the Skill instructions, the agent executes an unpinned global installation, `npx` invocation, or `@latest` upgrade. 5. Malicious lifecycle or runtime code executes with the permissions and ...[truncated 949 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific audited version rather than resolving the current registry version: ```bash npm install --save-exact @iqinghu/qhkit@<audited-version> ``` 2. Remove the automatic `@latest` upgrade instruction. Require explicit review and approval before changing versions. 3. Record and verify package integrity using a committed lockfile, npm integrity metadata, or a separately verified package artifact. 4. Prefer a project-local installation over `npm i -g` to avoid unnecessary changes to the user's global tool environment. 5. Run the CLI in a sandbox or restricted worker with: - Access only to explicitly selected input and output files. - Minimal environment variables. - No unrelated credentials. - Restricted outbound network destinations. - No administrative privileges. 6. Avoid unpinned `npx` execution. If `npx` is necessary, specify an exact audited version and prevent fallback to unexpected local binaries. 7. Disable npm lifecycle scripts where compatible: ```bash npm install --ignore-scripts --save-exact @iqinghu/qhkit@<audited-version> ``` If lifecycle scripts are required, audit them before installation. 8. Treat registry mirrors as separate trust boundaries. Use a controlled registry proxy or verify that artifacts and integrity metadata match the approved upstream package. 9. Keep API tokens out of command-line arguments and minimize their exposure to third-party processes. Use a permission-restricted configuration file, protected secret injection, or another mechanism supported by the CLI. ]]>