T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:36
- Finding
- Unpinned Third-Party Package Is Installed and Executed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6, 32–38, and 54–58 **Vulnerability Type**: Unpinned and globally installed third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"💧","requires":{"bins":["qhkit"]},"install":[{"kind":"node","package":"@iqinghu/qhkit","bins":["qhkit"]}]}} ``` ```bash npm i -g @iqinghu/qhkit ``` ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the Agent to install and execute `@iqinghu/qhkit` without pinning it to a reviewed version or integrity digest. The upgrade procedure explicitly selects `@latest`, allowing the effective executable code to change after this Skill has been audited. The package is installed globally rather than in an isolated, project-local environment. npm lifecycle scripts may execute during installation, and the installed CLI subsequently handles the service API token, local video paths, network uploads, and generated output. The package source and lockfile are not included in the reviewed project, so those operations cannot be independently verified by this audit. The alternative npm mirror does not inherently establish malicious behavior, but it adds another supply-chain source from which the mutable package may be retrieved. ### Attack Path 1. An attacker compromises the npm package, its publisher account, a release process, or a configured package-distribution source. 2. The attacker publishes a malicious release under the legitimate `@iqinghu/qhkit` package name. 3. The Agent follows the Skill instructions and resolves either the current unpinned release or `@latest`. 4. Malicious code executes through an npm lifecycle script during installation or when the `qhkit` command is invoked. 5. The code operates with the privileges of the account running npm. It can access that account's environment variables, submitted video files, API credentials, writable files, and available n ...[truncated 986 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to a specific, reviewed version instead of using an unversioned package or `@latest`. 2. Record and verify the expected package integrity digest. Use a committed lockfile and `npm ci` where possible. 3. Remove automatic upgrade instructions. Require review and integrity verification before adopting a new release. 4. Prefer a project-local installation over `npm i -g`, and invoke the pinned binary from the local dependency directory. 5. Audit npm lifecycle scripts before installation. Disable them with `--ignore-scripts` when they are not required. 6. Run the CLI as a dedicated, unprivileged user or inside a restricted container with access only to the explicitly selected input files and an isolated output directory. 7. Restrict outbound network access to the documented service endpoints where operationally feasible. 8. Avoid exposing unrelated secrets to the CLI process. Pass a narrowly scoped service token through a controlled secret mechanism and rotate it if compromise is suspected. 9. Document the upload destination, retention policy, privacy terms, and deletion process, and obtain user consent before uploading local media. 10. Vendor or publish auditable source for the dependency so its credential handling, upload behavior, and filesystem access can be reviewed. ]]>