T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:53
- Finding
- Mutable Global npm Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 53–58 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code**: ```markdown - If the command or required capability is missing, install or upgrade the published CLI: ```bash npm install -g @casatwy/deyo@^0.2.0 ``` ``` ### Technical Analysis The Skill directs the agent to install the third-party `@casatwy/deyo` npm package globally using the mutable semantic-version range `^0.2.0`. This range can resolve to later compatible `0.2.x` releases rather than one immutable, audited artifact. npm packages may execute lifecycle scripts during installation. If the publisher account, registry entry, or a future release satisfying this range is compromised, following this instruction could execute attacker-controlled installation code with the privileges of the user running npm. The global installation scope also modifies the user's shared command environment rather than isolating the dependency to the Skill or project. This finding concerns the unsafe dependency acquisition mechanism; the audit found no evidence that the currently referenced package is itself malicious. ### Attack Path 1. An attacker compromises the package publisher account, registry distribution channel, or another component of the package release process. 2. The attacker publishes a malicious `@casatwy/deyo` version accepted by `^0.2.0`. 3. A user invokes the Skill when the CLI is absent, outdated, or considered to lack a required capability. 4. The agent follows the documented global installation or upgrade command. 5. npm resolves the mutable malicious release and may execute its lifecycle scripts. 6. The malicious package executes with the invoking user's privileges and installs or replaces a globally accessible `deyo` command. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the account ...[truncated 515 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the mutable range with an exact, reviewed package version, for example `@casatwy/deyo@0.2.2`, and update it only through an explicit review process. 2. Verify the downloaded artifact using registry integrity metadata, provenance attestations, signatures, or a trusted lockfile. 3. Prefer a project-local or otherwise isolated installation instead of `npm install -g`, reducing the effect on the user's shared command environment. 4. Require explicit user consent before installation and display the exact package name, resolved version, registry, installation scope, and expected lifecycle-script behavior. 5. Use `--ignore-scripts` when the package does not require lifecycle scripts. If scripts are required, audit them before permitting execution. 6. Reject unexpected registries, owners, pre-release versions, or package provenance changes rather than attempting an automatic workaround. 7. Keep the existing security verification for managed OpenClaw updates, but apply equivalent immutable-version and provenance controls to the fallback npm installation path.