T08 · Insecure Dependencies
- Location
.github/workflows/clawhub-publish.yml:16- Finding
Mutable npm Dependency Executes with Access to a Publishing Token
- Content
View full analysis
Vulnerability Details
File Location:
.github/workflows/clawhub-publish.yml, lines 16–24
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: HighVulnerable Code
yaml - name: Install ClawHub CLI run: npm install -g clawhub@latest - name: Publish to ClawHub env: CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }} run: | mkdir -p "$HOME/.config/clawhub" echo "{\"registry\":\"https://clawhub.ai\",\"token\":\"$CLAWHUB_TOKEN\"}" > "$HOME/.config/clawhub/config.json" clawhub skill publish . --owner 987618350-cmdTechnical Analysis
The workflow installs
clawhub@latest, which is a mutable reference rather than a reviewed and immutable package version. Consequently, the code executed by this workflow can change without any corresponding repository change or review.npm installation can execute package lifecycle scripts. The installed CLI is then invoked in a later step after
CLAWHUB_TOKENhas been written in plaintext to$HOME/.config/clawhub/config.json. A compromised npm package, malicious maintainer release, or compromised package-publishing account could execute arbitrary code on the GitHub-hosted runner and read that configuration file.Although step-level environment variables are not automatically inherited by earlier steps, both steps run within the same job and filesystem. The installed package's CLI later executes while the token-bearing configuration file exists, giving malicious CLI code direct access to the credential.
Attack Path
- An attacker compromises the
clawhubnpm package, its maintainer account, or its publishing pipeline. - The attacker publishes a malicious release that becomes the version resolved by
clawhub@latest. - A push to
mainor a manual workflow dispatch starts the publishing job. - The workflow globally installs the malicious package without an immutable version or integrity constraint.
- The workflow writes
CLAWHUB_TOKENt ...[truncated 917 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
-
Replace
clawhub@latestwith an audited exact version, for example:yaml run: npm install -g clawhub@1.2.3 -
Prefer declaring the CLI as a project dependency, committing a lockfile, using
npm ci, and invoking the locked binary withnpx --no-install clawhub. -
Verify package provenance and integrity before execution. Where supported, require npm provenance attestations and use an approved internal registry or dependency allowlist.
-
Configure explicit least-privilege workflow permissions, such as:
yaml permissions: contents: read -
Pin GitHub Actions dependencies to reviewed commit SHAs rather than mutable major-version tags.
-
Restrict the ClawHub token to only the publication permissions and owner scope required by this workflow, rotate it periodically, and rotate it immediately if compromise is suspected.
-
Avoid persisting the token longer than necessary. Create the configuration with restrictive permissions, execute publication, and delete it in an
always()cleanup step:yaml - name: Configure and publish env: CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }} run: | umask 077 mkdir -p "$HOME/.config/clawhub" printf '%s\n' "{\"registry\":\"https://clawhub.ai\",\"token\":\"$CLAWHUB_TOKEN\"}" \ > "$HOME/.config/clawhub/config.json" npx --no-install clawhub skill publish . --owner 987618350-cmd - name: Remove publishing credentials if: always() run: rm -f "$HOME/.config/clawhub/config.json"
-