T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Dependency Installation Without a Lockfile or Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:12-19`; `scripts/package.json:1-8` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium The Skill instructs users to install a third-party npm dependency without providing a lockfile: ```markdown ## Setup (one-time) This skill uses Node.js and the npm package `solax-cloud-api`. Install dependencies inside the skill folder: ```bash cd /home/openclaw/.openclaw/workspace/skills/solax-summary-fetch/scripts npm install ``` (We use `npm install` instead of `npm ci` because this skill does not ship with a lockfile.) ``` The complete package manifest is: ```json { "name": "solax-summary-fetch-scripts", "private": true, "type": "module", "dependencies": { "solax-cloud-api": "0.2.0" } } ``` ### Technical Analysis The direct dependency is pinned to version `0.2.0`, which limits direct version drift. However, the project does not include a `package-lock.json`, so npm must resolve the dependency graph during each installation. Transitive versions and package integrity hashes are therefore not fixed or reviewable from the audited project. In addition, a normal `npm install` may execute dependency lifecycle scripts such as `preinstall`, `install`, or `postinstall`. Such scripts run with the privileges of the user performing the installation. The source and transitive dependency graph of `solax-cloud-api` were not included in the audited artifact, so their installation behavior, API destination, and handling of the Solax token and serial number could not be verified. This is a supply-chain exposure rather than evidence that the named dependency is currently malicious. ### Attack Path 1. An attacker compromises a transitive package resolved by `solax-cloud-api`, its registry account, or the package distribution channel. 2. The attacker publishes a malicious compatible release or modifies an installation artifact. ...[truncated 1047 chars]
- Remediation
- ## Remediation Suggestions 1. Generate and commit a reviewed `package-lock.json` so direct and transitive package versions and integrity hashes are reproducible. 2. Replace the setup instruction with `npm ci`, which installs exactly the locked dependency graph and fails if the manifest and lockfile differ. 3. Review the source, maintainership, publication history, lifecycle scripts, and transitive dependencies of `solax-cloud-api@0.2.0`. 4. If no dependency lifecycle scripts are required, install with `npm ci --ignore-scripts`. 5. Run installation and execution under a dedicated, unprivileged account or sandbox with access only to the files and network destinations required for the Solax API request. 6. Use dependency auditing and provenance controls in CI, and regenerate the lockfile only through a documented review process. 7. Restrict outbound network access to the verified Solax API endpoint after confirming the dependency's actual destination and transport-security behavior.