T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:37
- Finding
- Unpinned Third-Party Package Installation and Automatic Upgrades<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 37–64 **Vulnerability Type**: Unpinned and immediately executed third-party npm dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` The surrounding instructions also permit direct execution through `npx`: ```text Only when global installation fails due to permissions and privilege elevation is unavailable, fall back to `npx @iqinghu/qhkit <command> ...`. ``` The upgrade procedure installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` The instructions additionally allow switching from the official npm registry to: ```bash --registry=https://registry.npmmirror.com ``` ### Technical Analysis The Skill directs the Agent to install and execute `@iqinghu/qhkit` without pinning an audited version or verifying package integrity. It also instructs the Agent to install `@latest` in response to version notices returned by the remote CLI. Because npm packages can run lifecycle scripts during installation and subsequently execute arbitrary JavaScript, the effective code executed by the Skill can change after this Skill has been reviewed. A compromised package publisher, npm account, package release, registry response, or fallback mirror could therefore introduce arbitrary code. Using `npx` does not eliminate this risk because it can retrieve and immediately execute the package. A global installation also exceeds the minimum scope necessary for a single image-generation operation and leaves the package available beyond the immediate task. The separately flagged Node download pipeline is not a `curl | bash` execution pattern. It downloads a Node archive and validates it using `sha256sum -c` before extraction. However, because the archive and checksum manifest are obtained from the same selected origin, that validation does not protect against compromise of the origin itself. ### Attack Path 1. An attacker compromises the npm pack ...[truncated 1479 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version rather than using an unversioned package or `@latest`. 2. Verify the pinned package using a trusted integrity digest, signed provenance, or a reviewed lockfile. 3. Remove automatic upgrade instructions based solely on CLI-controlled messages. Require explicit user or administrator approval before changing executable dependencies. 4. Avoid global installation. Install the package into a dedicated, non-privileged project directory or isolated container with the minimum required filesystem and network access. 5. Avoid `npx` for unpinned packages because it can download and immediately execute mutable remote code. 6. Use one explicitly trusted registry. Do not silently switch to a mirror without separate trust validation and user approval. 7. Disable npm lifecycle scripts during installation where compatible, for example with `--ignore-scripts`, and separately audit any required setup behavior. 8. Restrict the CLI process so it can access only the intended input images and required configuration. 9. Supply API credentials through a scoped secret mechanism, use the minimum API permissions available, and prevent the token from being inherited by unrelated installation processes. 10. Prefer distributing a pre-reviewed, reproducible dependency bundle or container image rather than performing runtime dependency bootstrapping. ]]>