T08 · Insecure Dependencies
Error
- Location
- mcp.json:4
- Finding
- Execution of an Unverifiable and Mutable External Docker Image## Vulnerability Details **File Location**: `mcp.json:4-12` **Additional Locations**: `README.md:9-10`, `README.md:25-30`, `README.md:83-91`, `SKILL.md:27-43`, `SKILL.md:145-153`, `clawhub.yaml:10-13` **Vulnerability Type**: Unpinned and unverifiable external dependency **Risk Level**: High **Vulnerable Code**: ```json "kanban": { "command": "docker", "args": [ "run", "--rm", "-i", "your-dockerhub-username/mvp-kanban:latest", "python", "mcp_server.py" ], ``` The installation documentation also instructs users to retrieve the image directly: ```bash docker pull your-dockerhub-username/mvp-kanban:latest ``` ### Technical Analysis The MCP configuration launches `mcp_server.py` from an external Docker image whenever the Kanban MCP server is started. The image uses an unresolved placeholder publisher and the mutable `latest` tag. No immutable SHA-256 digest, image signature, verified registry namespace, source mapping, Dockerfile, or reproducible build instructions are included. Consequently, the actual executable payload is not part of the audited project and can change independently after review. The metadata is also inconsistent: `clawhub.yaml` declares `tag: v3.0.0`, while the executable image reference still explicitly uses `:latest`. The project contains only documentation and configuration files. It does not contain `mcp_server.py` or the implementation of the advertised 21 MCP tools, so the behavior of the executed server cannot be verified from this package. ### Attack Path 1. An attacker gains control of the referenced registry namespace, publishes under an unclaimed placeholder namespace, compromises the image publisher, or replaces the mutable `latest` tag. 2. The attacker publishes a modified image containing a malicious `mcp_server.py`. 3. A user follows the installation instructions or configures the supplied `mcp.json`. 4. OpenClaw starts the MCP serv ...[truncated 1109 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the placeholder image namespace with an image published by a verified and documented owner. 2. Pin the image using an immutable digest, for example: ```json "verified-publisher/mvp-kanban@sha256:EXPECTED_DIGEST" ``` 3. Do not use `latest` or rely solely on a mutable semantic-version tag for executable dependencies. 4. Sign the image and enforce signature or provenance verification before execution. 5. Include the corresponding application source, `Dockerfile`, lock files, and reproducible build instructions in the reviewed repository. 6. Ensure `clawhub.yaml`, `README.md`, `SKILL.md`, and `mcp.json` all reference the same immutable image. 7. Run the container as a non-root user with a read-only root filesystem, dropped Linux capabilities, resource limits, and restricted network access. 8. Avoid mounting host directories, credentials, or the Docker socket. If persistent data is required, grant access only to a dedicated volume containing Kanban data.