T08 · Insecure Dependencies
Error
- Location
- SKILL.md:44
- Finding
- Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 44-65 **Vulnerability Type**: Unpinned executable dependency and automatic supply-chain update **Risk Level**: High ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` The instructions also permit direct execution through: ```bash npx @iqinghu/qhkit <command> ... ``` They later direct the Agent to install the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to retrieve and execute `@iqinghu/qhkit` without pinning an audited version or package integrity value. The `@latest` upgrade instruction explicitly allows the effective executable payload to change after the Skill has been reviewed. Both npm installation and `npx` can execute package-controlled code. Depending on the package structure and npm configuration, this includes installation lifecycle scripts as well as the installed CLI. Consequently, compromise of the package, publisher account, package registry, or configured registry mirror could introduce arbitrary code without requiring a change to this repository. Global installation is broader than necessary for a single image-translation operation. It modifies the user's global npm environment and may make the executable available to unrelated future sessions. The documented mirror fallback also extends the supply-chain trust boundary beyond the primary npm registry. The separate Node.js bootstrap at lines 52-54 is not a `curl | bash` pipeline. It downloads a versioned archive and verifies it using `sha256sum -c` before extraction. It therefore does not constitute direct remote shell execution, although obtaining both the archive and checksum from the same selected origin does not protect against compromise of that origin. ### Attack Path 1. An attacker compromises the npm package publisher account, an authorized package release, the registry delivery path, or the configured mirror. 2. The atta ...[truncated 1391 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific version that has been independently reviewed; do not use an unqualified package name or `@latest`. 2. Record and verify the expected package integrity digest before executing the downloaded dependency. 3. Remove automatic upgrade instructions. Require explicit user approval and a security review before changing the pinned version. 4. Prefer a project-local or isolated installation over `npm i -g`, such as a dedicated container, temporary sandbox, or restricted npm prefix. 5. Do not use an unpinned `npx` invocation. If `npx` is retained, specify the exact audited version and prevent implicit substitution with an existing or newly resolved package. 6. Disable npm lifecycle scripts during installation where compatible with the package, then invoke only the reviewed entry point. 7. Allowlist trusted registries and avoid silently switching to a mirror. If a mirror is required, independently verify package integrity against a trusted, separately obtained value. 8. Run the CLI under a dedicated low-privilege account with access limited to the specific input images and output directory. Expose the API token only for the duration of the operation. 9. Document the external upload clearly and obtain user authorization before submitting local images to the service. ]]>