T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Remote Dependencies and Mutable Installation Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10–23 **Vulnerability Type**: Supply-chain exposure through unpinned remote dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill ev-charger ``` ```bash npx clawhub@latest install ev-charger # or: pnpm dlx clawhub@latest install ev-charger # or: bunx clawhub@latest install ev-charger ``` ### Technical Analysis The documented installation commands resolve and execute content from mutable remote sources. The GitHub installation is not pinned to a reviewed commit or immutable release, while the package-runner commands explicitly request the mutable `latest` version of `clawhub`. Tools such as `npx`, `pnpm dlx`, and `bunx` can download and execute package code during installation. Consequently, the effective installer code may change after this Skill has been reviewed. A compromised registry account, upstream repository, maintainer account, or future malicious release could therefore introduce code that was not part of the audited project. The reviewed Skill does not itself contain a malicious dependency. The risk arises when a user follows the documented installation instructions. ### Attack Path 1. An attacker compromises the `clawhub` package, its publishing account, the referenced GitHub repository, or another relevant upstream distribution channel. 2. The attacker publishes a malicious version under the mutable `latest` tag or modifies the repository's default branch. 3. A user follows one of the documented installation commands. 4. The package runner or installer retrieves the modified remote content. 5. The malicious package or installer code executes with the privileges of the user running the command. 6. Depending on those privileges, the payload could access user files, environment varia ...[truncated 653 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an explicitly reviewed package version. 2. Pin GitHub installations to an immutable commit hash rather than the repository's default branch. 3. Where supported, use package lockfiles and verify registry integrity hashes. 4. Publish expected checksums or signatures for released Skill artifacts and document how users can verify them. 5. Review installer lifecycle scripts and transitive dependencies before updating pinned versions. 6. Recommend installation under a non-privileged account and avoid suggesting `sudo` or administrator execution. 7. Use a controlled release process so dependency updates require review before documentation is changed. ]]>