T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:70
- Finding
- Unpinned Third-Party Package Installation and Runtime Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 70–91 **Vulnerability Type**: Unpinned and mutable npm dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```text Only when global installation fails due to permissions and privilege elevation is unavailable, fall back to: npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to download and execute `@iqinghu/qhkit` without pinning it to an exact, previously audited version or verifying package integrity. The package is required for the declared image-processing functionality, but resolving an unspecified version or `@latest` permits the executable content to change after the Skill itself has been reviewed. The `npx` fallback can download and immediately execute package code. Global installation also broadens the dependency's availability and impact beyond an isolated project environment. npm packages can execute JavaScript through package lifecycle hooks and through the installed CLI entry point. The documented fallback to `registry.npmmirror.com` additionally expands the set of infrastructure that must be trusted. No evidence shows that this mirror or the named package is currently malicious; the vulnerability is the mutable, unverified supply-chain execution process. The separately flagged command at line 79 is not a remote-script execution vulnerability. It downloads a checksum manifest and passes a selected entry to `sha256sum -c`; it does not pipe content into a shell. The Node.js archive is only extracted after checksum verification. ### Attack Path 1. An attacker compromises the npm package publisher account, package release process, npm registry delivery path, or configured fallback registry. 2. The attacker publishes or serves a malicious version of `@iqinghu/qhkit`. 3. The Agent follows the Skill's bootstrap or upgrade instructions using an ...[truncated 1278 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than using an unversioned package or `@latest`: ```bash npm install --global @iqinghu/qhkit@<reviewed-exact-version> ``` 2. Record and verify the expected package integrity hash or signed provenance before execution. Where practical, use a lockfile with an exact version and npm integrity metadata. 3. Remove automatic upgrades to `@latest`. Present the available update and require explicit user approval after the target version and release provenance have been reviewed. 4. Avoid global installation where possible. Install into an isolated, dedicated directory or ephemeral environment with only the filesystem and network access required for image processing. 5. Do not use `npx` as an automatic fallback for a package that has not already been verified. If it must be used, specify an exact version and prevent silent resolution to another release. 6. Consider installing with lifecycle scripts disabled when compatible with the package: ```bash npm install --ignore-scripts --global @iqinghu/qhkit@<reviewed-exact-version> ``` Test this configuration because some legitimate packages require installation scripts. 7. Prefer the primary npm registry and require explicit user approval before switching to a mirror. Apply the same version and integrity verification regardless of registry. 8. Run the CLI with least privilege. Expose only the requested input file, avoid unnecessary environment variables, and supply the service token through a narrowly scoped secret mechanism rather than a broadly inherited shell environment. ]]>