T08 · Insecure Dependencies
Error
- Location
- SKILL.md:5
- Finding
- Unpinned Third-Party Wallet Package Can Introduce Supply-Chain Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5`; supporting installation instructions at `README.md:27-28`, `README.md:199-202`, and `references/wallet-setup.md:7-14` **Vulnerability Type**: Unpinned security-sensitive third-party dependency **Risk Level**: High ### Vulnerable Code `SKILL.md:5`: ```yaml metadata: {"openclaw": {"emoji": "💰", "requires": {"bins": ["node"]}, "install": [{"id": "node", "kind": "node", "package": "llm-wallet-mcp", "bins": ["llm-wallet-mcp"], "label": "Install LLM Wallet MCP (node)"}]}} ``` `README.md:27-28`: ```bash # Install MCP server npm install -g llm-wallet-mcp ``` `README.md:199-202`: ```bash npm install -g llm-wallet-mcp # or npx llm-wallet-mcp ``` `references/wallet-setup.md:7-14`: ```bash npm install -g llm-wallet-mcp ``` ```bash npx llm-wallet-mcp ``` ### Technical Analysis The skill delegates all wallet and payment functionality to the external `llm-wallet-mcp` npm package without specifying an exact version, package integrity value, signature, or auditable lockfile. The `npx llm-wallet-mcp` instruction is particularly sensitive because it can retrieve the package's current registry release and execute it immediately. The repository contains documentation only and does not include the package implementation. Consequently, the audit cannot verify whether the distributed dependency correctly implements the documented AES-256-GCM wallet encryption, spending limits, approval checks, network defaults, private-key handling, or transaction-recipient validation. This dependency operates in a highly privileged security context. According to the documented functionality, it can import private keys, access the wallet encryption key, sign payment authorizations, initiate transactions, contact arbitrary paid APIs, and operate on Polygon mainnet with real USDC. An npm account compromise, malicious release, registry substitution, or unsafe transitive dependency could therefore introduce arbitrary code ...[truncated 2120 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin `llm-wallet-mcp` to an exact reviewed version in both installation metadata and documentation; do not use ranges or unversioned package references. 2. Record and verify the expected npm integrity digest or signed release provenance before installation. 3. Publish or vendor the implementation source corresponding exactly to the distributed artifact so that private-key handling, payment authorization, limit enforcement, and network selection can be audited. 4. Replace direct `npx llm-wallet-mcp` instructions with installation of a pinned, verified artifact followed by execution of that installed artifact. 5. Audit and lock all transitive dependencies, and use automated dependency monitoring for publisher, ownership, integrity, and release changes. 6. Inspect packages with lifecycle scripts disabled before allowing installation scripts to execute. Avoid elevated installation privileges. 7. Run the wallet process in a least-privilege sandbox with restricted filesystem and network access. Expose only the specific wallet storage and approved service endpoints it requires. 8. Keep mainnet wallets separate from test wallets, enforce low on-chain allowances and application spending limits, and require an independently validated user confirmation immediately before every real-value payment. 9. Store encryption and signing keys in an operating-system key store, hardware-backed signer, or dedicated secret manager rather than broadly accessible process environments where practical. ]]>