T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:57
- Finding
- Execution of Untrusted Upgrade Commands Returned by a Remote Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 57 **Vulnerability Type**: Remote command retrieval and execution **Risk Level**: High ### Vulnerable Code ```text **升级**：出现以下任一信号，先升级再重试原命令——命令返回 `{"ok":false,"stage":"version",...}`（版本门禁，message 里就是升级命令，照做即可）；stderr 提示有新版本；`options` 返回 `catalogNotice` 且用户恰好要用那个新模型；报「模式在线上已下架或配置变更，请升级 qhkit」。 ``` The relevant instruction translates to: “The message contains the upgrade command; execute it exactly as instructed.” ### Technical Analysis The Skill instructs the agent to treat the `message` field returned by `qhkit` as an executable upgrade command. Because `qhkit` communicates with an external service, the effective command can be influenced by systems outside the reviewed Skill package. There is no command allowlist, package-name validation, argument validation, version validation, shell metacharacter rejection, or user confirmation before execution. This creates a remote payload execution channel: the static Skill contains only the instruction to execute a command, while the command itself can change after the Skill has been reviewed. This behavior is not required for the declared image-pattern extraction functionality. A fixed, locally defined update operation would satisfy the legitimate update requirement without executing server-provided command text. ### Attack Path 1. The agent invokes `qhkit` while processing an image-generation request. 2. A compromised CLI dependency, service endpoint, service account, or upstream response returns a result with `stage:"version"`. 3. The attacker places an arbitrary shell command in the response's `message` field and presents it as an upgrade instruction. 4. The Skill directs the agent to execute that command verbatim. 5. The command runs with the privileges and filesystem/network access of the agent process. 6. The attacker can subsequently read or alter data accessible to that account, retrieve additional payloads, or establish persistence ...[truncated 766 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to execute the contents of the remote `message` field. 2. Treat all CLI output, including error and upgrade messages, as untrusted data intended only for display or structured parsing. 3. Define the permitted update command locally. Do not derive executable text from a remote response. 4. Pin the update to a reviewed version instead of using a server-selected command or the `latest` tag, for example: ```bash npm install --global @iqinghu/qhkit@<reviewed-version> ``` 5. Validate the selected version against a strict semantic-version pattern and a local allowlist. 6. Require explicit user approval before installing or updating software. 7. Prefer a user-scoped or isolated installation rather than a global installation. 8. If automated updating is essential, invoke the package manager directly with separately validated arguments and without passing data through a shell. 9. Log the requested version and verified package integrity, but never log API tokens or other secrets. ]]>