T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:62
- Finding
- Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 62–94 **Vulnerability Type**: Unpinned executable dependency and unsafe automatic upgrade **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the agent to install a third-party npm package globally, permits `npx` to retrieve and execute the package dynamically, and explicitly recommends upgrading to the mutable `latest` release. No exact package version, lockfile, package integrity value, or reviewed source code is included in the project. Consequently, the effective executable code can change after this Skill has been audited. Global npm installation may also execute package lifecycle scripts. The alternative npm mirror mentioned in the surrounding instructions introduces an additional supply-chain trust boundary. This is particularly sensitive because the installed CLI receives an API token and local portrait paths, uploads user images, and communicates with a remote service. The artifact contains no CLI implementation, so its credential handling, upload behavior, filesystem access, and network destinations cannot be independently verified. The separately flagged checksum pipeline at line 76 is not a `curl | bash` execution chain. It pipes a remotely obtained checksum entry through `grep` and into `sha256sum -c`; the downloaded text is not interpreted as shell code. The Node archive is checked before extraction. The confirmed issue is therefore the mutable npm executable dependency, not direct shell execution of the checksum file. ### Attack Path 1. An attacker compromises the npm publisher account, package namespace, registry distribution channel, or configured fallback mirror for `@iqinghu/qhkit`. 2. The attacker publishes a modified package under the expected name or as the mutable ` ...[truncated 1438 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific reviewed version rather than using an unversioned package reference or `@latest`. 2. Commit a lockfile with a registry-provided integrity value, or independently publish and verify a cryptographic digest for the approved package artifact. 3. Remove automatic upgrade instructions. Require security review and integrity verification before changing the approved version. 4. Avoid implicit `npx` downloads. If `npx` remains necessary, specify an exact version and configure it to reject unexpected package installation. 5. Prefer a project-local installation over a global installation to reduce system-wide effects and improve reproducibility. 6. Review npm lifecycle scripts before installation and disable them with `--ignore-scripts` where the package does not legitimately require them. 7. Publish or vendor auditable CLI source code and document expected network destinations, image-upload behavior, configuration-file locations, and token handling. 8. Store the API token with restrictive filesystem permissions, avoid exposing it in command history, and use a narrowly scoped and revocable token where supported. 9. Require explicit user consent before uploading portraits, and document the external service's data retention and privacy policy. 10. If a fallback registry mirror is permitted, verify that the downloaded artifact has the same independently trusted digest as the reviewed package.