T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:10
- Finding
- Unpinned Third-Party Installation Commands Permit Supply-Chain Compromise<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10–21 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash **Companion Skills**: This is part of the Camino AI location intelligence suite. Install all available skills (query, places, relationship, context, route, journey, real-estate, hotel-finder, ev-charger, school-finder, parking-finder, fitness-finder, safety-checker, travel-planner) for comprehensive coverage. ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill fitness-finder ``` **Via clawhub:** ```bash npx clawhub@latest install fitness-finder # or: pnpm dlx clawhub@latest install fitness-finder # or: bunx clawhub@latest install fitness-finder ``` ``` ### Technical Analysis The documented installation commands execute third-party package-runner code and retrieve Skill content from mutable upstream sources. The `clawhub@latest` reference explicitly selects whichever package release is current at installation time, while the GitHub URL does not specify a reviewed commit SHA or immutable release artifact. No lockfile, integrity hash, signature verification, or fixed package version is provided. Consequently, the code installed or executed by a user may differ from the version that was security-reviewed. If an npm publisher account, package, GitHub account, repository, release process, or other upstream distribution component is compromised, an attacker could replace the expected content with malicious code. This finding concerns unsafe dependency installation guidance. The audited files themselves contain no evidence that the current upstream packages are malicious. ### Attack Path 1. An attacker compromises an upstream package publisher, distribution account, repository, or release process associated with the documented ...[truncated 1321 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `clawhub@latest` with an explicitly reviewed package version. 2. Pin the GitHub dependency to an immutable full commit SHA rather than the repository's mutable default branch. 3. Record and verify cryptographic integrity hashes for downloaded release artifacts where the package manager supports them. 4. Prefer signed releases and document how users can verify the publisher identity and artifact signature. 5. Commit an appropriate lockfile when dependencies are installed as part of a managed project. 6. Review package lifecycle scripts and the complete transitive dependency tree before approving a new version. 7. Use an automated dependency-update process that opens reviewable changes rather than resolving the newest release during installation. 8. Run installation in a least-privileged or isolated environment without unrelated credentials. 9. Update the examples to use commands conceptually equivalent to: ```bash npx clawhub@<reviewed-version> install fitness-finder npx skills add https://github.com/barneyjm/camino-skills#<full-reviewed-commit-sha> --skill fitness-finder ``` The placeholders must be replaced with versions and commit identifiers that have actually been reviewed and approved. ]]>