T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:89
- Finding
- Unpinned Remote npm Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 89-94; additional occurrences at lines 14 and 105 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```markdown ## Setup Steps 1. **Install the GitHub App** on your org at [github.com/apps/pharaoh-so](https://github.com/apps/pharaoh-so) — grants read-only access to selected repos 2. Pharaoh auto-maps selected repos into a knowledge graph (typically < 5 minutes) 3. Run `npx @pharaoh-so/mcp --install-skills` — installs skills + connects MCP server 4. Authorize via the device code shown in terminal (opens GitHub OAuth in browser) 5. Your agent now queries architecture instead of reading files one at a time ``` The same mutable package invocation also appears in the installer and logout instructions: ```markdown Running `npx @pharaoh-so/mcp --install-skills` performs these actions: ``` ```markdown npx @pharaoh-so/mcp --logout ``` ### Technical Analysis The documented `npx @pharaoh-so/mcp` commands do not specify an exact package version or an integrity digest. Consequently, `npx` can resolve, download, and execute whichever package release is current when the user runs the command. The executable payload can therefore change after this Skill has been reviewed. The package is documented as modifying `~/.openclaw/skills/` and `~/.openclaw/openclaw.json`. During normal operation, it also handles OAuth credentials stored under `~/.pharaoh/credentials.json` and proxies repository-related MCP messages. Although the documentation links to a public source repository, that link alone does not establish that a subsequently resolved npm artifact is identical to reviewed source. This is a supply-chain risk rather than evidence that the current package is malicious. Exploitation would require compromise of the npm publisher, package distribution channel, or a future malicious release. ### Attack Pat ...[truncated 1578 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every documented invocation to a reviewed exact version, for example: ```bash npx --yes @pharaoh-so/mcp@0.3.5 --install-skills ``` Version pinning reduces unexpected updates but does not by itself protect against replacement of an existing registry artifact. 2. Publish and verify package provenance, registry signatures, or cryptographic integrity hashes. Document how users can validate that the npm artifact corresponds to the reviewed source and release commit. 3. Prefer installation through a lockfile-controlled workflow using `npm ci`, with a committed integrity-bearing lockfile, rather than dynamically executing the latest registry release. 4. Separate installation, authentication, and logout operations where practical. A logout operation should not require downloading and executing a mutable remote package merely to delete local credentials. 5. Run installation with the minimum necessary privileges. Do not use `sudo`, and restrict package access to only the required OpenClaw and Pharaoh configuration paths. 6. Review and pin the 23 Skill files installed by the external package. Their contents were not included in this artifact and therefore were outside the scope of this audit. 7. Document a trusted release-verification procedure, including the expected package version, source commit, package digest, and provenance attestation.