T08 · Insecure Dependencies
Error
- Location
- SKILL.md:17
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed Automatically## Vulnerability Details **File Location**: `SKILL.md`, lines 17–25 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "toolrouter": { "command": "npx", "args": ["-y", "toolrouter-mcp"] } } } ``` ### Technical Analysis The documented configuration runs `npx -y toolrouter-mcp` without specifying an exact package version, integrity hash, lockfile, or other verification mechanism. When OpenClaw starts the configured MCP server, `npx` may retrieve the package release currently selected by the npm registry and execute its installation or runtime code with the permissions of the OpenClaw process. The `-y` option suppresses the normal installation confirmation, eliminating an opportunity for the user to inspect the selected package and version. Because the configuration is placed in the persistent OpenClaw configuration file, subsequent launches may retrieve and execute a newer package release whose contents differ from those available when the Skill was reviewed. This creates a supply-chain trust boundary in which compromise of the npm package, its publisher account, or the associated publishing process could turn the documented setup command into an arbitrary local code-execution channel. ### Attack Path 1. An attacker compromises the `toolrouter-mcp` npm publisher account, publishing pipeline, or package distribution channel. 2. The attacker publishes a malicious package version containing harmful installation or runtime code. 3. A user or agent follows the Skill instructions and adds the unversioned `npx -y toolrouter-mcp` command to `~/.openclaw/openclaw.json`. 4. OpenClaw launches the configured MCP server. 5. `npx` resolves and downloads the attacker-controlled release without interactive confirmation. 6. The malicious package executes with the operating-system permissions and accessi ...[truncated 906 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example `toolrouter-mcp@1.0.2`, rather than resolving the latest available release. 2. Install the dependency through a committed lockfile and verify its npm integrity metadata or cryptographic signature before execution. 3. Remove `-y` from security-sensitive setup instructions so that unexpected package resolution requires explicit user approval. 4. Prefer a locally installed, reviewed binary referenced by an absolute path instead of downloading package code during every launch. 5. Require explicit user consent before modifying `~/.openclaw/openclaw.json`, and display the exact package name, version, source, and permissions involved. 6. Run the MCP server in a restricted environment with minimal filesystem access, a sanitized environment, limited outbound network access, and no unnecessary credentials. 7. Establish a controlled dependency-update process that reviews release changes, verifies provenance, and tests each new version before deployment. 8. Restrict the gateway to explicitly approved tools and capabilities rather than exposing the entire remote catalog by default.