T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:41
- Finding
- Unpinned Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41–71 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions also permit execution through: ```bash npx @iqinghu/qhkit <command> ... ``` ### Technical Analysis The Skill directs the agent to install and execute the externally maintained `@iqinghu/qhkit` npm package. The initial installation does not pin a version, while the upgrade procedure explicitly selects `@latest`. Consequently, the code ultimately executed can change after the Skill itself has been reviewed. Global npm installation can execute package lifecycle scripts and installs executable files into the user's global npm environment. Those operations run with the privileges of the user invoking npm. The permitted `npx` fallback may likewise download and execute a package that is not already present locally. The Skill also permits use of `registry.npmmirror.com` as a fallback registry. Although described as a mirror, this creates an additional supply-chain trust boundary. The project supplies no lockfile, package integrity value, audited source revision, or other mechanism for verifying the exact `qhkit` package contents before execution. The Node.js bootstrap command is not a `curl | bash` pipeline. It downloads a version-pinned archive and verifies it against the corresponding SHA-256 checksum list before extraction: ```bash curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - ``` This pipeline sends checksum text to `grep` and `sha256sum`; it does not send downloaded content to a shell. That portion is therefore not classified as remote payload execution. ### Attack Path 1. A user invokes the Skill to optimize a product image. 2. The agent de ...[truncated 1250 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a reviewed, exact version rather than using an implicit current version or `@latest`. 2. Record and validate npm package integrity metadata, and retain a lockfile or equivalent verifiable dependency manifest. 3. Prefer a project-local installation in an isolated working directory instead of modifying the user's global npm environment. 4. Avoid automatic upgrades during normal Skill execution. Require explicit user approval before installing or changing executable software. 5. Where compatible with the package, disable npm lifecycle scripts during installation and invoke only reviewed entry points. 6. Treat registry mirrors as separate trust boundaries. Use a configured trusted registry and verify package integrity regardless of the selected source. 7. Run the CLI in a restricted environment with access only to the selected input images, required network destinations, and a narrowly scoped API token. 8. Inform users before uploading local images to the external service, and document the destination, retention policy, and token permissions. 9. Preserve the existing version-pinned Node.js download and SHA-256 verification procedure; do not replace it with a `curl | shell` command. ]]>