T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Mutable External Git Source Used for Global CLI Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 8-15 **Vulnerability Type**: Supply-chain exposure through an externally fetched package pinned to a mutable Git tag **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"💼","requires":{"bins":["linkedin-cli"],"env":["LINKEDIN_CLIENT_ID","LINKEDIN_CLIENT_SECRET","LINKEDIN_ACCESS_TOKEN"]},"install":[{"id":"npm","kind":"shell","command":"npm install -g github:0xmythril/linkedin-cli#v1.0.0","bins":["linkedin-cli"],"label":"Install linkedin-cli v1.0.0 (npm)"}]}} ``` ```bash npm install -g github:0xmythril/linkedin-cli#v1.0.0 ``` ### Technical Analysis The installation procedure downloads and installs executable code directly from a personal GitHub repository. Although the source is pinned to the `v1.0.0` tag, Git tags can be moved or recreated by a repository administrator and therefore do not provide the immutability of a reviewed commit hash or a cryptographically verified archive. The downloaded implementation, package manifest, lockfile, and dependency tree are not included in the audited project. Consequently, the assertions in `SKILL.md` that the package has no installation scripts, has only three runtime dependencies, and communicates exclusively with LinkedIn cannot be independently verified from the available artifact. The `-g` option installs the package globally. Any npm lifecycle script present in the retrieved package could execute with the privileges of the user running npm, while the installed CLI will subsequently receive access to LinkedIn OAuth credentials. This behavior grants externally controlled code substantial authority relative to the Skill's narrow posting functionality. ### Attack Path 1. An attacker compromises the GitHub repository owner account, repository, release workflow, or another component involved in dependency resolution. 2. The attacker moves or recreates the `v1.0.0` tag, or modifies an unpinne ...[truncated 1364 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installation to a reviewed, immutable full Git commit hash rather than a release tag. 2. Obtain the source archive through a controlled release process and verify a documented cryptographic checksum before installation. 3. Include the reviewed source, `package.json`, and lockfile in the audit scope so lifecycle scripts, dependencies, and network destinations can be verified. 4. Prefer a project-local or isolated installation over `npm install -g` to reduce the affected scope. 5. Use `npm install --ignore-scripts` when the verified package does not require lifecycle scripts. 6. Pin all transitive dependencies through a lockfile and use integrity hashes. 7. Verify repository ownership, release signatures, package contents, and the resolved commit before installation. 8. Run the CLI with only the required environment variables and avoid exposing unrelated credentials or sensitive directories.