T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:169
- Finding
- Unpinned External Skill Installation Creates a Mutable Supply-Chain Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 169-172 **Vulnerability Type**: Unpinned third-party Skill dependency **Risk Level**: Medium ### Vulnerable Code ```markdown - **Install in project**: `git clone https://github.com/privy-io/privy-agentic-wallets-skill.git .cursor/skills/privy` (or into `~/.openclaw/workspace/skills/privy` for OpenClaw). Add `PRIVY_APP_ID` and `PRIVY_APP_SECRET` from [dashboard.privy.io](https://dashboard.privy.io). ``` ### Technical Analysis The documented installation procedure clones the current default branch of a third-party Git repository directly into an active Skill directory. It does not pin a reviewed commit or release and does not require signature, checksum, or content verification. Consequently, the effective Skill content installed by this command can differ from the content that was originally reviewed. Because the destination is a directory from which Cursor or OpenClaw may load agent instructions, changes or compromise of the upstream repository could introduce attacker-controlled instructions into a wallet-enabled environment. The risk is increased by the adjacent instruction to configure `PRIVY_APP_ID` and `PRIVY_APP_SECRET`. A malicious dependency loaded in that environment could attempt to influence the agent into disclosing credentials, invoking wallet APIs, or performing unauthorized signing operations. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its default branch. 2. The attacker adds malicious or misleading instructions to the external Skill. 3. A user follows the documented `git clone` command without specifying a reviewed commit. 4. The mutable repository content is placed in `.cursor/skills/privy` or the OpenClaw Skill directory. 5. The agent loads and trusts the newly installed Skill. 6. In a Privy-enabled environment, the malicious instructions attempt to misuse configured credentials ...[truncated 641 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a reviewed immutable commit: ```sh git clone https://github.com/privy-io/privy-agentic-wallets-skill.git /tmp/privy-skill-review cd /tmp/privy-skill-review git checkout --detach <reviewed-commit-sha> ``` 2. Verify the commit against a trusted release, signed tag, or independently distributed checksum. 3. Review every Skill instruction, script, manifest, and referenced executable before moving the content into an active Skill directory. 4. Record the approved repository URL, commit hash, review date, and expected file hashes in project documentation. 5. Do not automatically update the dependency. Require security review before changing the pinned revision. 6. Keep `PRIVY_APP_SECRET` in a server-side secret manager and prevent Skill content, browser code, logs, and prompts from reading it. 7. Apply restrictive Privy wallet policies, including contract allowlists, recipient restrictions, per-transaction limits, cumulative spending limits, and network restrictions. 8. Prefer installing into a staging directory first rather than cloning external content directly into an active agent Skill directory.