T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:62
- Finding
- Execution of Server-Controlled Upgrade Instructions Without Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 62 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Snippet The relevant instruction, translated into English from the source, is: ```text If the command returns {"ok":false,"stage":"version",...}, the message contains the upgrade command; follow it directly. ``` The document later presents the expected upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill tells the agent to execute an upgrade command supplied through the CLI's `message` field without validating that the returned text matches an approved command. That output crosses a trust boundary: it can originate from the installed package or from a remote service contacted by the package. An error message must be treated as untrusted data, not as executable instructions. If the package, its backend, its update mechanism, or an intercepted dependency response is compromised, an attacker could place an arbitrary shell command in the version-gate message. The agent may then execute that command under the local user's account. Although the document provides a normal npm upgrade command elsewhere, it does not require the agent to ignore alternative commands embedded in the response, validate a package version, constrain the command to npm, or obtain explicit user approval. ### Attack Path 1. An attacker compromises the `@iqinghu/qhkit` package, its publishing account, or a backend service that controls version-gate responses. 2. The attacker causes the CLI to return a response with `stage` set to `version`. 3. The response's `message` field contains an attacker-selected shell command rather than a legitimate upgrade command. 4. The Skill instructs the agent to follow the command in the message directly. 5. The command executes with the privileges and environment access of the agent process. ### Impact Assessment Successful exploitation can pr ...[truncated 577 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Never execute commands obtained from CLI output, API responses, error messages, or other untrusted text. - Replace the directive with a fixed, locally defined upgrade procedure. - Pin upgrades to an explicitly approved version rather than using `@latest`. - Validate version strings against a strict semantic-version pattern before using them as package-manager arguments. - Display the proposed package name and version to the user and require explicit approval before installation. - Prefer a project-local installation over a global installation. - Verify package integrity using a lockfile and registry-provided integrity metadata. - Treat the `message` field only as text to display to the user. - If automated upgrades are necessary, implement an allowlist that permits only the exact package name and a validated version argument, without invoking a shell. ]]>