T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:15
- Finding
- Unpinned Third-Party Installation Sources Enable Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md`, lines 15–23 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill context ``` **Via clawhub:** ```bash npx clawhub@latest install context ``` ### Technical Analysis The installation instructions execute dynamically obtained npm tooling and install Skill content from a GitHub repository without pinning an immutable package version, commit hash, or integrity digest. The explicit `@latest` tag is mutable, while the GitHub repository URL resolves according to upstream repository state rather than a reviewed commit. Consequently, the code ultimately downloaded and executed can change after this project has been audited. If the npm packages, publisher accounts, GitHub repository, or associated release process are compromised, an attacker could substitute malicious installer behavior or Skill content. Package runners such as `npx` execute downloaded package code under the invoking user's account, so a malicious release could perform actions beyond merely copying the Skill. ### Attack Path 1. An attacker compromises the publisher account, npm package, GitHub repository, or upstream release workflow referenced by the installation commands. 2. The attacker publishes a malicious version under the mutable `latest` tag or modifies the repository branch resolved by the unpinned GitHub URL. 3. A user follows the documented installation instructions. 4. `npx`, `pnpm dlx`, or `bunx` retrieves and executes the mutable package, or the installer retrieves modified repository content. 5. Malicious installer code executes with the permissions of the invoking user or installs altered Skill instructions and scripts. 6. The payloa ...[truncated 855 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact package version. Do not use mutable version ranges or distribution tags in security-sensitive installation instructions. 2. Pin the GitHub source to a specific reviewed commit SHA rather than the repository's default branch. 3. Record and verify cryptographic integrity information for downloaded artifacts, such as npm lockfile integrity values, release checksums, or verified signatures. 4. Prefer a trusted package manager workflow with a committed lockfile over ad hoc runtime package execution. 5. Verify package publisher identity, repository ownership, release provenance, and package signatures before installation. 6. Execute installation in a least-privileged, isolated environment without unrelated credentials or sensitive environment variables. 7. Add automated dependency monitoring and require security review before updating pinned versions or commit references.