T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:78
- Finding
- Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 78-99 **Vulnerability Type**: Supply-chain risk caused by mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code At line 78, the Skill recommends globally installing the package without pinning a version: ```bash npm i -g @iqinghu/qhkit ``` Lines 81 and 96 additionally permit installation through an alternative registry: ```text --registry=https://registry.npmmirror.com ``` Lines 96-99 explicitly instruct the Agent to install the latest available release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill depends on the third-party npm package `@iqinghu/qhkit` to communicate with the declared remote image-processing service. Installing this dependency is functionally related to the Skill, but the documented installation procedure does not constrain the package to a reviewed version or integrity digest. Both an omitted version and the `@latest` tag are mutable references. Consequently, the code executed during a future installation can differ from the code present when the Skill was audited. npm packages may execute lifecycle scripts during installation, so a compromised package release, publisher account, registry, or distribution path could cause arbitrary local code to run before the intended CLI is invoked. The `-g` option broadens the installation scope by placing the package and executable in the active global npm prefix. The resulting privileges depend on how the Agent process is running. Under an ordinary account, compromise would generally be limited to that account and its accessible files, credentials, and processes. If npm is run through an elevated shell, the package's installation scripts could execute with elevated privileges and modify system-wide locations. The optional mirror increases the number of distribution systems that must be trusted. The audit found no evidence that the named pa ...[truncated 2237 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed, rather than omitting the version or using `@latest`. 2. Record and verify package integrity using a lockfile, trusted integrity digest, or an equivalent reproducible dependency mechanism. 3. Prefer a project-local or isolated installation over `npm i -g` so that compromise is contained to the Skill's execution environment. 4. Where package compatibility permits, install with npm lifecycle scripts disabled and explicitly review any scripts that must be enabled. 5. Require explicit user approval before installing or upgrading dependencies, particularly when an upgrade was suggested only by remote CLI output or stderr. 6. Do not run npm with `sudo`, as root, or from another elevated context. Document the expected unprivileged installation path. 7. Remove automatic `@latest` upgrades. Publish a reviewed compatibility matrix and update the pinned version only after auditing the new release. 8. Minimize alternate registry use. If a mirror is necessary, apply the same exact-version and integrity verification requirements used for the primary registry. 9. Consider distributing a reviewed, locked dependency bundle or executing the CLI in a sandbox with restricted filesystem, network, and credential access.