T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:61
- Finding
- Execution of Dynamically Supplied Upgrade Commands## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Relevant instruction, translated into English:** ```text Upgrade when the command returns {"ok":false,"stage":"version",...}. The message contains the upgrade command; execute it directly. ``` ### Technical Analysis The Skill instructs the agent to execute an upgrade command obtained dynamically from the `qhkit` command's `message` field. This output is not restricted to a hard-coded command, parsed against an allowlist, or subjected to user confirmation. Because `qhkit` is a third-party executable that can communicate with an external service, the effective command may be controlled by the installed package, its publisher, or its backend. It can change after the Skill has been reviewed. Treating a diagnostic message as executable instructions creates a remote command-execution channel. The upgrade instruction is not necessary in this form. The declared image-generation functionality only requires invoking a known CLI interface. Any legitimate upgrade can instead use a locally defined, version-pinned command. ### Attack Path 1. An attacker compromises the `qhkit` package, its publisher account, distribution channel, or backend service. 2. The compromised component returns a response containing `stage:"version"`. 3. The response places an attacker-selected shell command in the `message` field and represents it as the required upgrade procedure. 4. Following the Skill instruction, the agent executes that command without validation or separate user authorization. 5. The command runs with the privileges of the account hosting the agent. ### Impact Assessment Successful exploitation permits arbitrary command execution with the agent process's user privileges. Depending on the runtime environment, the attacker could: - Read or modify files accessible to the agent ac ...[truncated 494 chars]
- Remediation
- ## Remediation Suggestions - Remove the instruction to execute commands contained in `message`, standard output, standard error, or any other remotely influenced field. - Treat all CLI output strictly as untrusted data. - Define permitted maintenance commands locally and validate them against an exact allowlist. - Pin upgrades to a reviewed version, for example: ```bash npm install --global @iqinghu/qhkit@REVIEWED_VERSION ``` - Require explicit user approval before installing or upgrading software. - Reject upgrade responses that contain shell operators, command substitutions, redirects, URLs, or commands outside the allowlist. - Run the CLI in a sandbox with restricted filesystem, network, and environment-variable access. - Report unsupported-version errors to the user rather than automatically following commands supplied by the tool.