T08 · Insecure Dependencies
Warning
- Location
SKILL.md:127- Finding
Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk
- Content
View full analysis
=1.0.0", "obsidian-git-vault": ">=1.0.0" } ``` ### Technical Analysis The documented installation procedure retrieves and installs externally maintained skills without pinning exact versions. The `>=1.0.0` constraints permit any current or future release satisfying the range. The audited project contains no lockfile, package-integrity hashes, reviewed vendor copies, or immutable source commit references. Because the two external skills are expected to interact with Huawei health data, an Obsidian vault, Git synchronization, and scheduled operations, their effective privileges may include access to sensitive health records, local files, repository credentials, and recurring task configuration. The audited artifact does not establish that either dependency is currently malicious. The vulnerability is that package behavior can change after this project has been reviewed, without requiring a modification to the reviewed artifact. ### Attack Path 1. An attacker compromises the registry account, source repository, or release process of an accepted dependency. 2. The attacker publishes a malicious version satisfying the `>=1.0.0` constraint. 3. A user follows the documented `npx clawhub install` commands. 4. The installer resolves and installs the attacker-controlled release. 5. The dependency executes with the permissions available to the OpenClaw environment. 6. Malicious dependency behavior may read, alter, or transmit health records, vault contents, Git credentials, or scheduled-task configuration. ...[truncated 473 chars]- Remediation
View remediation
=1.0.0`. 2. Provide a lockfile or equivalent immutable dependency-resolution record. 3. Record and verify package integrity hashes before installation. 4. Reference reviewed source commits or signed releases from authoritative repositories. 5. Audit the complete contents and installation hooks of both external skills. 6. Document the registry and package publisher identities so users can validate provenance. 7. Require explicit user confirmation before installing or updating dependencies. 8. Run external skills with least privilege and restrict their access to unrelated files, credentials, and network destinations. 9. Establish a controlled update process that performs a new security review before accepting later releases. ]]>