T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party Installation Commands Permit Supply-Chain Code Substitution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13-23 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill query ``` ```bash npx clawhub@latest install query # or: pnpm dlx clawhub@latest install query # or: bunx clawhub@latest install query ``` ### Technical Analysis The documented installation procedures execute third-party package runners and retrieve skill content from mutable sources. The GitHub commands do not pin the repository to a reviewed commit hash or signed release. The package-runner commands explicitly use `@latest`, causing installation behavior to depend on whichever package version is current at execution time. Consequently, the code installed by users can differ from the code that was audited. If a package registry account, package release process, source repository, or maintainer account is compromised, an attacker can replace or modify the retrieved installation payload. This is a supply-chain weakness rather than evidence that the currently reviewed files contain a malicious payload. ### Attack Path 1. An attacker compromises the relevant package registry account, GitHub repository, maintainer credentials, or release pipeline. 2. The attacker publishes a malicious version of the package or modifies the repository's default branch. 3. A user follows one of the documented installation commands. 4. `npx`, `pnpm dlx`, or `bunx` retrieves the current mutable package, or the installer retrieves the current repository head. 5. Malicious installation or skill code executes under the user's account. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the user performing the installation. Depending on that user's per ...[truncated 269 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `@latest` with an explicitly reviewed package version. - Pin GitHub installations to a full immutable commit hash rather than the repository's default branch. - Publish and verify cryptographic integrity hashes for downloaded artifacts. - Prefer signed releases and document signature-verification procedures. - Use lockfiles where supported and review dependency changes before upgrading. - Avoid executing package-runner downloads directly in sensitive environments; retrieve and inspect the package before execution. - Run installation with the minimum necessary user privileges and without unrelated secrets in the environment. ]]>