T08 · Insecure Dependencies
Error
- Location
- README.md:51
- Finding
- Unpinned and Unverifiable Third-Party Package Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:56-60`, `README.md:24-27`, `README.md:51-64`, `README.md:172-176`, and `package.json:5-9` **Vulnerability Type**: Supply-chain exposure through mutable, unaudited registry packages **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:56-60`: ```bash npm install clawhub-publisher # or pip install clawhub-publisher ``` `README.md:51-64`: ```bash npm install clawhub-publisher ``` ```bash pip install clawhub-publisher ``` ```bash npm install -g clawhub-publisher clawhub-publisher --version clawhub-publisher login --token YOUR_API_KEY ``` `README.md:172-176`: ```yaml - run: npm install clawhub-publisher - run: npx clawhub-publisher publish \ --api-key ${{ secrets.CLAWHUB_API_KEY }} \ --skill-path ./my-skill \ --version ${GITHUB_REF#refs/tags/v} ``` `package.json:5-9`: ```json "main": "index.js", "bin": { "clawhub-publisher": "bin/cli.js" }, ``` ### Technical Analysis The documentation instructs users and CI environments to install and execute `clawhub-publisher` from npm or PyPI without an exact version, integrity hash, lockfile, or verified registry namespace. Consequently, the effective code can change after this Skill has been reviewed. The package manifest claims that the Node.js implementation exists at `index.js` and `bin/cli.js`, but neither file is present in the audited project. The project also contains no Python implementation. Therefore, the code that would process API credentials, inspect local skill directories, modify files, and publish assets is not available for review. The same package name is presented for two separate ecosystems without evidence that both registry packages are controlled by the same trusted publisher. This creates package-identity ambiguity and increases exposure to dependency confusion, abandoned-package takeover, typosquatting, or publication of an unrelated package. Global installation and direct `npx` execution further increase ...[truncated 1770 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin every installation command to an exact reviewed version, for example: ```bash npm install --save-exact clawhub-publisher@1.0.0 ``` Do not use floating tags such as `latest`. 2. Commit a lockfile containing package integrity data and require immutable, lockfile-based CI installation: ```bash npm ci --ignore-scripts ``` 3. Publish and document cryptographic checksums, package signatures, provenance attestations, and the exact official registry namespace. 4. Include `index.js`, `bin/cli.js`, and all other executable implementation files in the reviewed project. The manifest must not reference absent executables. 5. Remove the PyPI installation instructions unless an independently reviewed Python distribution is intentionally maintained and its ownership and integrity can be verified. 6. Avoid global installation and unrestricted `npx` execution. Run the reviewed, locally pinned dependency instead. 7. Disable lifecycle scripts during installation unless they are required and have been audited. If scripts are necessary, document each script and its security purpose. 8. Avoid passing API keys as command-line arguments because process listings and CI logs may expose them. Read credentials from a protected environment variable or secret file with restrictive permissions. 9. Apply least privilege to ClawHub credentials. Use short-lived, scoped tokens limited to the required skill and publishing action. 10. Run publishing in an isolated CI job with a minimal workspace, restricted network access, read-only source files where possible, and no unrelated repository or cloud secrets. 11. Add automated dependency monitoring and fail builds when package provenance, integrity, expected publisher identity, or locked versions change. ]]>