T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party Installation Commands Enable Supply-Chain Compromise## Vulnerability Details **File Location**: `SKILL.md`, lines 13-25 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium The installation documentation directs users to execute third-party package runners using the mutable `latest` tag and to install code from a GitHub repository without pinning a reviewed commit. ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill journey ``` ```bash npx clawhub@latest install journey # or: pnpm dlx clawhub@latest install journey # or: bunx clawhub@latest install journey ``` ### Technical Analysis The `npx`, `pnpm dlx`, and `bunx` commands download and execute packages from an external package registry. Using `clawhub@latest` permits the executed package version to change after this project has been reviewed. No cryptographic checksum, signature, or lockfile constrains the retrieved artifact. Likewise, the GitHub installation commands reference the repository's mutable default branch rather than a specific reviewed commit SHA or immutable release. Consequently, the code installed by these commands can differ from the version considered during this audit. This creates a supply-chain trust boundary in which compromise of the package publisher account, registry artifact, repository, or upstream maintainer can introduce arbitrary code into the installation process. ### Attack Path 1. An attacker compromises the relevant package publisher account, package registry artifact, GitHub repository, or upstream maintainer workflow. 2. The attacker publishes a malicious version under the `latest` tag or modifies the repository's mutable default branch. 3. A user follows the documented installation command. 4. The package runner retrieves the attacker-controlled version or repository content. 5. Installer logic, package lifecycle scrip ...[truncated 767 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with a specific, reviewed package version, for example: ```bash npx clawhub@<reviewed-version> install journey ``` 2. Pin GitHub installations to a full reviewed commit SHA rather than the mutable default branch: ```bash npx skills add https://github.com/barneyjm/camino-skills.git#<full-commit-sha> --skill journey ``` 3. Publish and verify cryptographic checksums or signed provenance for downloaded releases and installer artifacts. 4. Use lockfiles and integrity metadata where the package manager supports them. 5. Review package lifecycle scripts and disable unnecessary lifecycle execution during installation when supported. 6. Document the exact trusted package version, repository commit, expected checksum, and verification procedure. 7. Run installation with a non-privileged account in an isolated environment, limiting access to secrets and sensitive files.