T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:12
- Finding
- Unpinned Third-Party Installation Commands Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-24 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill school-finder ``` ```bash npx clawhub@latest install school-finder # or: pnpm dlx clawhub@latest install school-finder # or: bunx clawhub@latest install school-finder ``` ### Technical Analysis The documented installation commands execute third-party package tooling and install content from mutable sources. The GitHub commands do not pin the repository to a reviewed commit, while the package-manager commands explicitly use the mutable `latest` release tag. No checksum, lockfile, signature, exact version, or commit identifier is provided to verify that users receive the same content that was audited. The repository-wide installation command also installs all available skills rather than only the component required for the stated school-finder functionality. This unnecessarily expands the dependency, code, and instruction trust surface. This issue is contingent on an upstream package, repository, release process, or maintainer account being compromised. The audited project itself does not contain evidence that those upstream sources are currently malicious. ### Attack Path 1. An attacker compromises the upstream npm package, GitHub repository, release pipeline, or a maintainer account. 2. The attacker publishes malicious installation logic under the `latest` package tag or modifies the repository's default branch. 3. A user follows one of the documented installation commands. 4. `npx`, `pnpm dlx`, or `bunx` downloads and executes the mutable package, or the installer retrieves the modified repository content. 5. The malicious installer or installed skill executes with the privileges of the invok ...[truncated 873 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin package-manager tools to exact, reviewed versions instead of using `@latest`, for example: ```bash npx clawhub@<reviewed-version> install school-finder ``` 2. Pin GitHub installations to a reviewed immutable commit hash or signed release tag rather than the repository's default branch. 3. Publish and verify cryptographic checksums or package signatures where the installation mechanism supports them. 4. Recommend installation of only the `school-finder` skill by default. Present suite-wide installation as an explicit optional action with a clear explanation of the additional trust surface. 5. Maintain lockfiles or equivalent integrity metadata for installation tooling and review dependency changes before updating pinned versions. 6. Document the expected package publisher, repository owner, version, and commit so users can verify provenance before executing installation commands. ]]>