T08 · Insecure Dependencies
- Location
.github/workflows/clawhub-publish.yml:17- Finding
Unpinned ClawHub CLI Executes with a Publishing Credential
- Content
View full analysis
Vulnerability Details
File Location:
.github/workflows/clawhub-publish.yml, lines 17–26
Vulnerability Type: Unpinned third-party dependency in a privileged publishing workflow
Risk Level: HighVulnerable Code
yaml - name: Install ClawHub CLI run: npm install -g clawhub@latest - name: Publish to ClawHub env: CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }} run: | mkdir -p "$HOME/.config/clawhub" echo "{\"registry\":\"https://clawhub.ai\",\"token\":\"$CLAWHUB_TOKEN\"}" > "$HOME/.config/clawhub/config.json" clawhub skill publish . --owner 987618350-cmdTechnical Analysis
The workflow installs
clawhub@latest, whose effective version can change between otherwise identical workflow executions. Consequently, the repository does not define or review the exact code that will run.The globally installed CLI is subsequently invoked in a step where
CLAWHUB_TOKENis available both as an environment variable and in$HOME/.config/clawhub/config.json. A malicious or compromised future release of the npm package could therefore read and exfiltrate that credential whenclawhub skill publishexecutes. npm installation scripts associated with the package would also execute during the installation step, although the publishing token is not introduced until the following step.This is a supply-chain risk rather than evidence that the current ClawHub package is malicious. The vulnerable condition is the workflow's trust in an unreviewed, mutable dependency version.
Attack Path
- An attacker compromises the
clawhubnpm package, its publisher account, or its release process. - The attacker publishes a malicious version that becomes the version resolved by the
latestdistribution tag. - A push to
mainor a manual workflow dispatch starts the publishing job. npm install -g clawhub@latestinstalls the attacker-controlled ...[truncated 1176 chars]
- An attacker compromises the
- Remediation
View remediation
Remediation Suggestions
- Replace
clawhub@latestwith a specific, reviewed version:yaml - name: Install ClawHub CLI run: npm install -g clawhub@1.2.3 - Prefer a repository-managed dependency with a committed lockfile and install it using
npm ci, so the exact resolved package and transitive dependency versions are reproducible. - Review the selected package version, its transitive dependencies, and any lifecycle scripts before approving upgrades. Use automated dependency updates that require review rather than a mutable distribution tag.
- If supported by the package, suppress unnecessary lifecycle scripts with
--ignore-scripts; verify that doing so does not prevent legitimate installation. - Scope
CLAWHUB_TOKENto publishing only the intended skill and owner. Use a short-lived or automatically rotated credential where supported. - Rotate the current token if there is evidence that an untrusted CLI release has run with it.
- Avoid persisting the token to a plaintext file when the CLI supports environment-only authentication. If a file is required, set restrictive permissions and remove it immediately after publication:
bash install -d -m 700 "$HOME/.config/clawhub" umask 077 printf '%s\n' "{\"registry\":\"https://clawhub.ai\",\"token\":\"$CLAWHUB_TOKEN\"}" \ > "$HOME/.config/clawhub/config.json" trap 'rm -f "$HOME/.config/clawhub/config.json"' EXIT
- Replace