T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–67 **Vulnerability Type**: Supply-chain exposure through unpinned npm installation, immediate `npx` execution, and automatic latest-version upgrades **Risk Level**: Medium ### Complete Code Snippet ```bash npm i -g @iqinghu/qhkit ``` ```text Default to the official npm registry. If the official registry is slow or times out, add: --registry=https://registry.npmmirror.com Only when global installation fails because of permissions and privilege elevation is unavailable, use: npx @iqinghu/qhkit <command> ... ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ```text If the official registry is slow or times out, likewise add: --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning an exact reviewed version or verifying package integrity. It also explicitly directs upgrades to `@latest`, allowing the effective executable code to change after the Skill itself has been audited. The `npx` fallback may download and immediately execute the current package version. Global installation additionally gives the dependency broader availability than a project-local installation requires. Use of a registry mirror introduces another supply-chain trust boundary, even though the documented mirror is not itself evidence of malicious behavior. This is not evidence that the current package is malicious. The vulnerability is that package execution depends on mutable, externally controlled artifacts without version or integrity constraints. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry infrastructure, or an accepted mirror. 2. The attacker publishes or serves a malicious release under the legitimate `@iqinghu/qhkit` package name. 3. The Agent follows the Skill instructions and runs an unpinned global installation, an immediate `npx` invocation, or an ...[truncated 911 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact version that has been reviewed instead of using an implicit current version or `@latest`. 2. Remove automatic upgrade instructions. Require review and validation before changing the pinned version. 3. Prefer a project-local dependency with a committed lockfile over global installation. 4. Verify package integrity using a trusted lockfile integrity value or independently published digest. 5. Avoid immediate remote execution through `npx`; execute only a previously installed and verified local package. 6. Disable npm lifecycle scripts during installation where compatible, then explicitly run only required reviewed setup steps. 7. Treat registry mirrors as separate trust boundaries. Use them only when explicitly approved and apply the same version and integrity checks. 8. Run the CLI in a restricted environment with access limited to the specific input images, output directory, required token, and documented service endpoints. 9. Document the package's remote endpoints and data-handling behavior so users can make an informed decision before images and credentials are provided. ]]>