T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:45
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 45–48 and line 66 **Vulnerability Type**: Unpinned dependency installation and execution **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to download and execute `@iqinghu/qhkit` without pinning it to a reviewed version or verifying package integrity. The `npx` fallback can retrieve and immediately execute the registry's current package version. The explicit `@latest` upgrade instruction likewise allows future, unaudited package contents to replace the installed implementation. npm package installation may execute package lifecycle scripts, while subsequent CLI invocation executes the installed package with the privileges of the invoking user. Therefore, compromise of the package publisher, npm registry account, configured mirror, or a future package release could turn this documented installation process into arbitrary local code execution. The global installation is broader than necessary for a single Skill. It modifies the user's shared tool environment and may affect other sessions or projects. The instructions do not require root access, and thus no privilege escalation is confirmed; however, the package receives all permissions already held by the invoking user. The separate Node.js bootstrap at lines 53–55 is not a `curl | bash` flow. It downloads a versioned archive and verifies it with the corresponding SHA-256 manifest before extraction, so it is not the confirmed issue reported here. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry delivery path, or fallback mirror used for `@iqinghu/qhkit`. 2. The attacker publishes a malicious package version under the legitimate package name or alters a future release. 3. Th ...[truncated 1271 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific version that has been independently reviewed instead of using an unqualified package name or `@latest`. 2. Record and verify the expected npm package integrity hash before installation. 3. Remove automatic `@latest` upgrades. Require review and integrity updates before accepting a new release. 4. Avoid `npx` behavior that implicitly downloads current registry content. If `npx` remains necessary, specify an exact reviewed version and require explicit user approval before retrieval. 5. Prefer a project-local or isolated installation over `npm i -g`, such as a dedicated container or restricted execution environment. 6. Run the CLI with minimum filesystem and network access, exposing only the selected image files and required service endpoint. 7. Provide the token through a scoped environment variable or protected credential mechanism rather than command-line arguments, and ensure it is not exposed to logs. 8. Pin the registry endpoint and document its trust assumptions. Do not silently switch to a mirror without user approval and equivalent integrity verification. 9. Disable npm lifecycle scripts during installation where compatible, or explicitly audit all required lifecycle scripts before permitting them.