T08 · Insecure Dependencies
Warning
- Location
scripts/setup_memory.sh:104- Finding
Automatic Installation of an Unpinned Third-Party Plugin
- Content
View full analysis
/dev/null; then if openclaw plugins list 2>/dev/null | grep -q "lossless-claw"; then echo " ✓ Lossless Claw already installed" else echo " Installing @martian-engineering/lossless-claw..." openclaw plugins install @martian-engineering/lossless-claw && echo " ✓ Installed" || echo " ⚠ Install failed — run manually: openclaw plugins install @martian-engineering/lossless-claw" ``` Related unpinned installation instructions also appear in: - `SKILL.md:128-129` - `SKILL.md:249` - `SKILL_v0.md:82-83` ```bash pip install qmd openclaw plugins install @martian-engineering/lossless-claw npm install -g openclaw ``` ### Technical Analysis The setup script automatically requests the current registry-resolved release of `@martian-engineering/lossless-claw`. It does not pin a reviewed version, validate a checksum or signature, enforce a lockfile, display the resolved version before installation, or require explicit installation confirmation. The accompanying documentation similarly recommends unpinned Python, npm, and OpenClaw plugin installation commands. Consequently, the effective code installed by these commands can change after this Skill has been reviewed. Package installers and plugin installation systems commonly execute package-controlled installation hooks or load installed plugin code into the host application. Therefore, compromise of a publisher account, package registry, dependency chain, or future package release could cause attacker-controlled code to execute under the identity of the user running the setup. No evidence was found that the named packages are currently malicious. The confirmed issue is the unsafe, mutable dependency acquisition process. ### Attack Path 1. An attacker compromises the r ...[truncated 1849 chars]- Remediation
View remediation
python3 -m pip install 'qmd==' npm install -g 'openclaw@' ``` 2. Verify package integrity using registry-supported signatures, provenance attestations, or published cryptographic checksums. Fail closed when integrity verification cannot be completed. 3. Require explicit user confirmation before installing third-party software. Keep workspace initialization separate from optional dependency installation so users can create memory files without executing external package code. 4. Print the exact package name, resolved version, source registry, and expected integrity value before installation. 5. Use lockfiles or an equivalent reviewed dependency manifest for all direct and transitive dependencies. 6. Configure trusted registries explicitly and avoid silently accepting alternate indexes, mirrors, or user-controlled package sources. 7. Perform installation and runtime execution under a dedicated, least-privileged account with access restricted to the required workspace. 8. Update the documentation to recommend only pinned commands and to explain that users should review package provenance and release contents before installation. 9. Add automated dependency scanning and periodically re-review pinned versions before intentionally upgrading them. ]]>