T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:13
- Finding
- Unpinned Third-Party Installers and Mutable Skill Sources## Vulnerability Details **File Location**: `SKILL.md`, lines 13-23 **Vulnerability Type**: Supply-chain risk from unpinned dependencies and mutable sources **Risk Level**: Medium ### Vulnerable Code ```bash # Install all skills from repo npx skills add https://github.com/barneyjm/camino-skills # Or install specific skills npx skills add https://github.com/barneyjm/camino-skills --skill travel-planner ``` ```bash npx clawhub@latest install travel-planner # or: pnpm dlx clawhub@latest install travel-planner # or: bunx clawhub@latest install travel-planner ``` ### Technical Analysis The documented installation commands execute npm-distributed installer tools and retrieve Skill content without pinning the tools or downloaded content to reviewed, immutable versions. The `@latest` tag is mutable and can resolve to a different package version each time the command is executed. Likewise, the GitHub repository URL does not specify a reviewed commit hash or signed release. Consequently, the code and instructions installed by these commands can change after this artifact has been audited. An attacker who compromises an upstream package, package-publishing account, repository, maintainer account, or mutable release could distribute malicious code or Skill instructions through these otherwise legitimate-looking installation commands. ### Attack Path 1. An attacker compromises the `clawhub` or `skills` package distribution channel, a relevant publisher account, or the referenced GitHub repository. 2. The attacker publishes a malicious package version or modifies the repository content retrieved by the unpinned URL. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx`, `pnpm dlx`, or `bunx` downloads and executes the attacker-controlled installer version, or the installer retrieves attacker-controlled Skill content. 5. The malicious component operates with the permissions and environment available ...[truncated 537 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed package version. 2. Pin GitHub installation sources to a reviewed commit hash rather than a mutable branch. 3. Publish and verify cryptographic integrity hashes for downloaded artifacts. 4. Prefer signed releases and configure the installer to verify signatures before execution. 5. Use package-manager lockfiles or equivalent integrity metadata where applicable. 6. Review new package and Skill versions before updating documented pins. 7. Run installation in a least-privileged, isolated environment without unnecessary credentials. 8. Avoid executing remotely sourced package installers directly when an independently verifiable download-and-review workflow is available.