T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:61
- Finding
- Execution of Upgrade Commands Supplied Through Dynamic CLI Messages## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: Remote payload retrieval and execution through untrusted command instructions **Risk Level**: High ### Vulnerable Snippet The following is a faithful English translation of the instruction at line 61: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; execute it as instructed. ``` ### Technical Analysis The Skill instructs the agent to execute an upgrade command supplied dynamically in the CLI's `message` field. It does not require the command to match an allowlist, validate its syntax, or restrict execution to a fixed package-management operation. The message could be influenced by the installed CLI, its remote service, or an update endpoint. Consequently, a compromised package, service account, API response, or network trust boundary could replace the expected upgrade instruction with an arbitrary shell command. This behavior exceeds the privileges required for storyboard generation. The Skill only needs to invoke a known CLI version; it does not need authority to execute arbitrary commands returned by that CLI or its remote service. ### Attack Path 1. An attacker compromises the `qhkit` package, update service, API response path, or associated publishing account. 2. The compromised component returns a response with `stage` set to `version`. 3. The response's `message` field contains a malicious command instead of a legitimate update command. 4. The Skill treats the message as trusted executable guidance. 5. The agent executes the supplied command under its current operating-system account. 6. The malicious command can access files, environment variables, API tokens, and network resources available to that account. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the agent process. This may expose the `QHKIT_TOKEN`, other environment credentials, u ...[truncated 354 chars]
- Remediation
- ## Remediation Suggestions - Never execute commands extracted from a CLI or server-provided `message` field. - Treat response messages as display-only diagnostic text. - Replace the dynamic behavior with a fixed, locally defined update command. - Pin updates to an explicitly reviewed version rather than accepting an arbitrary version from the response. - Require explicit user approval before installing or upgrading software. - Validate the package name, version, registry, and integrity metadata before installation. - Run package installation in a restricted environment without access to unrelated secrets or sensitive files. - Log the version-gate response for review, but do not interpret it as executable shell input. A safer update workflow would use a locally controlled command such as: ```bash npm install --global @iqinghu/qhkit@REVIEWED_VERSION ``` The actual reviewed version should replace `REVIEWED_VERSION`; it should not be obtained from an executable server-supplied message.