T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:73
- Finding
- Unpinned Third-Party CLI Is Installed and Executed Globally## Vulnerability Details **File Location**: `SKILL.md`, lines 73-105 **Vulnerability Type**: Unpinned executable dependency and unsafe automatic upgrade **Risk Level**: Medium ### Vulnerable Code ```bash npm i -g @iqinghu/qhkit ``` When global installation fails, the document recommends executing the package through `npx`: ```bash npx @iqinghu/qhkit [command] ``` The upgrade procedure also installs the mutable latest release: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill instructs the agent to install and execute the third-party `@iqinghu/qhkit` npm package without pinning an exact reviewed version or verifying the package's integrity. The explicit `@latest` upgrade instruction ensures that executable code can change after the Skill has been audited. Both global npm installation and `npx` can execute package-controlled code, including npm lifecycle scripts and the installed CLI. Consequently, trust is transferred from the reviewed Skill document to the current state of the package registry, package publisher account, configured npm registry, and all transitive dependencies. Global installation also has a broader scope than an isolated project-local installation. It places an executable in the user's command environment and allows subsequent invocations of `qhkit` to run whichever package version was installed. Although the instructions do not demand elevated privileges and offer `npx` when global installation lacks permission, the installation model still exceeds the safest minimum necessary for the declared media-generation workflow. The separately flagged download pipeline is not a remote-script execution vulnerability. It sends an official checksum manifest through `grep` and into `sha256sum -c`; it does not pipe downloaded content into a shell. The Node archive is also supposed to be extracted only after successful checksum verification. ### Attack Path 1. An attacker comp ...[truncated 1574 chars]
- Remediation
- ## Remediation Suggestions 1. Pin `@iqinghu/qhkit` to an exact reviewed version rather than using an unversioned package name or `@latest`. 2. Record and verify the package integrity value from a trusted source before installation. Where possible, use a lockfile with integrity metadata. 3. Remove automatic upgrade instructions. Require new releases to undergo review before changing the pinned version. 4. Install the dependency in an isolated, project-local environment rather than globally. Invoke the pinned local binary directly. 5. Avoid unpinned `npx` execution. If `npx` is unavoidable, specify the exact approved version and prevent implicit substitution with a different package release. 6. Disable npm lifecycle scripts during installation when the reviewed package does not require them, and separately review any scripts that must be enabled. 7. Run the CLI in a least-privilege sandbox or container with access restricted to the specific input media, output directory, API endpoint, and token required for the workflow. 8. Use the official npm registry or a controlled internal registry. If a mirror is required, define and verify its trust policy rather than switching sources automatically. 9. Keep the Qinghu token out of command history and package-accessible configuration where possible. Supply a narrowly scoped token through a protected secret mechanism and rotate it following suspected dependency compromise.