T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party CLI Installation and Automatic Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:46`, and `SKILL.md:71` **Vulnerability Type**: Unpinned executable dependency and unsafe automatic upgrade path **Risk Level**: Medium ### Complete Code Snippet ```yaml metadata: {"openclaw":{"emoji":"📸","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` The fallback execution and upgrade instructions also use an unpinned package: ```bash npx @iqinghu/qhkit <command> ... npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill delegates its core functionality to the executable npm package `@iqinghu/qhkit`. It instructs the Agent to install that package globally, execute it through `npx`, or upgrade it to the registry's current `latest` release. No exact reviewed version, lockfile, package-integrity value, or immutable artifact digest is specified. Consequently, the code executed by the Skill may change after this Skill has been reviewed. The package implementation is not included in the audited project, so this audit cannot verify its lifecycle scripts, local file access, token handling, network destinations, update behavior, or generated-image processing. The documented use of the package requires access to a Qinghu API token and user-selected local product images. A compromised package release, registry publisher account, dependency, or configured registry mirror could therefore execute attacker-controlled code with the privileges of the user running the Agent. Global installation increases system-wide exposure within that user's npm environment, while `npx` can retrieve and immediately execute code that has not been locally reviewed. This is a supply-chain weakness rather than evidence that the current package is malicious. The separately flagged Node.js checksum pipeline does not constitute a confirmed `curl | bash` issue. It downloads an archive from the official No ...[truncated 2027 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed, rather than using an implicit current version or `@latest`: ```bash npm install --global @iqinghu/qhkit@<reviewed-exact-version> ``` 2. Record and verify the npm package integrity digest or distribute a lockfile generated from a trusted registry. Reject installation if the resolved version or integrity value differs from the reviewed value. 3. Remove automatic `@latest` upgrades. Treat version-gate messages as a request for explicit user approval and security review before installing a new version. 4. Avoid automatic `npx` retrieval and execution. If `npx` must be supported, specify an exact version and require confirmation before downloading executable code: ```bash npx --yes @iqinghu/qhkit@<reviewed-exact-version> ... ``` 5. Prefer a project-local or isolated installation over a global installation. Execute the CLI in a restricted container or sandbox with access only to the specific input images and required configuration. 6. Disable npm lifecycle scripts where compatible, or audit all required lifecycle scripts before permitting them: ```bash npm install --ignore-scripts ... ``` 7. Document the CLI's expected network destinations, uploaded data, token-storage location, and privacy policy. Obtain user confirmation before uploading local images or marketing text. 8. Provide the token through a narrowly scoped, short-lived mechanism where supported. Do not place it directly in command history, logs, generated parameter files, or diagnostic output. 9. Keep the existing Node.js checksum verification, but strengthen it by pinning the expected SHA-256 digest within reviewed Skill content or validating a signed release manifest instead of trusting a checksum fetched from the same origin at installation time. ]]>