T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:66
- Finding
- Unpinned Third-Party CLI Installation and Automatic Upgrade## Vulnerability Details **File Location**: `SKILL.md`, lines 66–72 and 94–98 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The Skill metadata also declares the dependency without an exact version: ```yaml metadata: {"openclaw":{"emoji":"🔬","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ### Technical Analysis The Skill instructs the Agent to install and execute the mutable npm package `@iqinghu/qhkit` globally. Neither the metadata installation declaration nor the primary installation command pins an exact package version. The upgrade command explicitly requests the latest available release. Consequently, the executable code installed during a future invocation may differ from the code available when the Skill was audited. npm installations may also run package lifecycle scripts. If the package publisher, maintainer account, npm distribution channel, or documented fallback mirror is compromised, attacker-controlled code could execute during installation or when `qhkit` is invoked. Global installation is broader than necessary for a single image-processing task: it modifies the user-level or system-level Node.js command environment and persists after task completion. Although the document recommends `npx` after a global installation permission failure, that fallback is also unpinned and still retrieves mutable package code. The separately flagged pipeline at line 79 is not a `curl | bash` execution primitive: ```bash cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` It passes downloaded checksum text to `grep` and `sha256sum`, not to a shell. The Node.js archive is extracted only after checksum validation, so that pipelin ...[truncated 1450 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a reviewed exact version in both Skill metadata and all installation commands; do not use `@latest`. 2. Record and verify the package integrity hash from a trusted lockfile or independently controlled manifest before execution. 3. Replace global installation with a task-scoped local installation in an isolated directory or container, and remove it after completion. 4. Avoid automatic upgrades based solely on CLI output or stderr notices. Require explicit user approval and security review before changing versions. 5. Use `npm install --ignore-scripts` where the package remains functional without lifecycle scripts. If scripts are required, inspect and approve them before installation. 6. Pin the `npx` fallback to the same reviewed exact version and prevent it from silently resolving a newer release. 7. Prefer the official npm registry. If a mirror is required, verify package integrity against independently trusted metadata rather than trusting the mirror for both the package and its verification data. 8. Run the CLI with only the filesystem, network, and credential access needed to upload the selected image and poll the workflow. Do not expose unrelated secrets to the process.