T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:6
- Finding
- Unpinned Third-Party CLI Installation and Automatic Upgrade<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6, 40–45, and 65–69 **Vulnerability Type**: Unpinned executable dependency and unsafe automatic upgrade **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🌀","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npx @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill installs and executes `@iqinghu/qhkit` without pinning it to a reviewed version. The package metadata, ordinary installation command, `npx` fallback, and automatic `@latest` upgrade can all retrieve executable package content that changes after this Skill has been audited. Installing an npm package can execute package lifecycle scripts. The installed CLI subsequently runs with the permissions and environment of the invoking process. Consequently, compromise of the package publisher, publishing credentials, registry delivery path, or a future package release could result in arbitrary local code execution. The documented fallback to `registry.npmmirror.com` additionally expands the trusted supply chain. Fetching a package and its metadata from the same registry or mirror does not provide independent integrity verification. Use of the CLI is necessary for the declared image-generation functionality, but globally installing an unpinned package and automatically upgrading to `@latest` exceed the minimum necessary trust and system modification. A project-local, exactly pinned, integrity-verified dependency would provide a narrower security boundary. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, registry delivery path, or configured mirror for `@iqinghu/qhkit`. 2. The attacker publishes or serves a malicious version as the current default or `latest` version. 3. The Skill runs `npm i -g @iqinghu/qhkit`, ` ...[truncated 1276 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version in both metadata and installation examples: ```bash npm install --global @iqinghu/qhkit@EXACT_VERSION ``` 2. Remove automatic installation of `@latest`. Treat upgrades as a separate, reviewed maintenance action rather than an automatic response to runtime messages. 3. Avoid unpinned `npx` execution. If `npx` is retained, specify the exact version and prevent silent substitution: ```bash npx --yes @iqinghu/qhkit@EXACT_VERSION ``` 4. Prefer a project-local or isolated installation over a global installation to reduce modification of the user's tool environment. 5. Commit and enforce a lockfile with npm integrity data where the execution environment supports it. Verify the expected package tarball digest against a value maintained independently of the download registry. 6. Use the primary npm registry only where possible. If a mirror is required, document the additional trust boundary and verify artifacts against independently obtained hashes. 7. Evaluate whether the package functions correctly with lifecycle scripts disabled: ```bash npm install --ignore-scripts @iqinghu/qhkit@EXACT_VERSION ``` If lifecycle scripts are required, review and document them before deployment. 8. Run the CLI with minimum filesystem access, no elevated privileges, and only the environment variables required for the request. Supply the API token only to the specific CLI process where practical. 9. Explicitly inform users that selected local images are uploaded to an external service before invoking the CLI. ]]>