T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Globally Installed Executable Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:54`, and `SKILL.md:75` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🎨","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs the executable npm package `@iqinghu/qhkit` without pinning an audited version or enforcing a package-integrity digest. The upgrade instruction explicitly installs `@latest`, allowing the package's effective code and behavior to change after the Skill itself has been reviewed. Because npm installation can execute package lifecycle scripts, a compromised package release, registry account, or configured mirror could result in arbitrary code execution during installation. The risk is elevated by the global installation scope and by the CLI's subsequent access to Qinghu API tokens, local image paths, generated assets, and network resources. The fallback use of `registry.npmmirror.com` creates an additional supply-chain trust dependency. This is not evidence that the mirror or package is malicious, but installation from either source without version and integrity enforcement leaves the Skill exposed to future upstream compromise. The Node.js bootstrap checksum pipeline at `SKILL.md:60-61` is not a `curl | bash` execution pattern. It downloads a fixed archive and validates it with `sha256sum -c` before extraction. Therefore, that pipeline is not classified as a confirmed vulnerability. ### Attack Path 1. An attacker compromises the npm publisher account, an upstream package release, or a configured package mirror. 2. The attacker publishes a malicious version of `@iqinghu/qhkit`, potentially containing a malicious npm lifecycle script or altered CLI implementation. 3. The Agent foll ...[truncated 1598 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed: ```bash npm install -g @iqinghu/qhkit@<audited-version> ``` 2. Remove the automatic `@latest` upgrade instruction. Require review and approval of each new version before deployment. 3. Record and verify package integrity using a committed lockfile, expected npm integrity value, or an equivalent cryptographic verification mechanism. 4. Prefer a project-local or isolated installation over a global installation. Run the CLI from a constrained environment with access only to the files required for the current image-generation request. 5. Avoid administrative privileges. Do not recommend privilege escalation merely to make a global npm installation succeed. 6. Disable npm lifecycle scripts during installation where compatible: ```bash npm install --ignore-scripts @iqinghu/qhkit@<audited-version> ``` If lifecycle scripts are required, review them before permitting execution. 7. Verify package provenance, publisher identity, release history, and registry source before installation. Apply equivalent integrity controls when using the fallback mirror. 8. Provide the CLI token only at invocation time, use a narrowly scoped and revocable token where supported, and prevent unrelated processes from inheriting it. 9. Execute the dependency in a sandbox or container with restricted filesystem and network access to reduce the impact of a future supply-chain compromise. ]]>