T08 · Insecure Dependencies
Warning
- Location
docs/openclaw-setup.md:76- Finding
Unpinned Remote npm Package Is Downloaded and Executed During Setup
- Content
View full analysis
- Remediation
View remediation
metrics schema ``` 2. Do not rely on a mutable npm distribution tag in security-sensitive setup instructions. Review and deliberately update the pinned version when required. 3. Where practical, install through a lockfile-backed workflow and verify package integrity or provenance before execution. 4. Explicitly remove unrelated credentials from the command environment. If the diagnostic does not need the token, use: ```bash env -u VERCEL_TOKEN npx --yes vercel@ metrics schema ``` 5. If the diagnostic requires the Vercel token, disclose that the downloaded package receives the credential and advise using a narrowly scoped, short-lived token. 6. Prefer implementing an equivalent diagnostic through this Skill's existing fixed-endpoint, redirect-disabled HTTP client. That would avoid introducing an additional package-execution boundary and preserve the existing credential-redaction controls. 7. Consider changing the documentation to download or install the pinned package separately, verify it, and only then execute it, rather than combining retrieval and execution in one command. ]]>