T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party Installer Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 13-25 **Vulnerability Type**: Supply-chain risk through mutable third-party installers **Risk Level**: Medium ```bash npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill places ``` **Via clawhub:** ```bash npx clawhub@latest install places # or: pnpm dlx clawhub@latest install places # or: bunx clawhub@latest install places ``` ### Technical Analysis The documented installation commands execute third-party npm packages and retrieve content from a GitHub repository without pinning them to immutable versions or commit hashes. In particular, the `@latest` tag is mutable, while the repository URL does not identify a reviewed commit. No integrity hash or signature-verification procedure is supplied. Consequently, the code executed when a user follows these instructions can differ from the code available at audit time. Although no malicious behavior was identified in the bundled `scripts/places.sh`, the installation path crosses an unverified supply-chain boundary. ### Attack Path 1. An attacker compromises the npm publisher account, the relevant package, the GitHub repository, or an upstream maintainer account. 2. The attacker publishes a malicious release under `latest` or modifies the repository branch resolved by the installer. 3. A user follows one of the documented `npx`, `pnpm dlx`, or `bunx` installation commands. 4. The package runner downloads and executes the mutable installer or repository content. 5. Malicious installation code runs with the permissions of the invoking user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that account's permissions and local environment, an attacker could read or alter user-accessible files, access environment variables ...[truncated 226 chars]
- Remediation
- ## Remediation Suggestions - Replace `@latest` with an explicitly reviewed package version. - Pin the GitHub source to a specific immutable commit hash rather than a mutable branch or repository default. - Use npm lockfiles and integrity metadata where the installation workflow supports them. - Publish expected checksums or signatures and document how users must verify downloaded artifacts before execution. - Prefer a trusted registry release with provenance attestations and reproducible build information. - Review dependency updates before changing pinned versions, and automate supply-chain scanning for newly approved releases. - Avoid recommending package-runner commands that immediately execute freshly downloaded code unless its identity and integrity are verified.