T08 · Insecure Dependencies
Warning
- Location
SKILL.md:113- Finding
Mutable npm Package Executed Through Unpinned npx Commands
- Content
View full analysis
--version --name "" /absolute/path/to/skill-dir ``` At `SKILL.md:194-198`: ```bash npx clawhub@latest login npx clawhub@latest whoami npx clawhub@latest publish --slug X --version Y . npx clawhub@latest inspect npx clawhub@latest search ``` ### Technical Analysis The Skill repeatedly instructs users or agents to execute `npx clawhub@latest`. The `latest` distribution tag is mutable and does not identify a fixed, previously reviewed package release. Depending on the local npm cache and configuration, `npx` may retrieve the package from the configured npm registry and execute its code immediately. Consequently, reviewing this repository does not establish which implementation will execute later. A compromised package publisher account, malicious future release, registry compromise, or unsafe registry configuration could cause attacker-controlled code to run without any corresponding change to the audited Skill. The commands include authentication and publication operations. The downloaded CLI may therefore execute in a process with access to ClawHub credentials, npm configuration, the source and publishable Skill directories, and other files available to the invoking account. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publisher account, its release process, or the registry endpoint used by the victim. 2. The attacker publishes a malicious package release and assigns or causes it to receive the `latest` distribution tag. 3. A user or agent follows the instructions in `SKILL.md` and runs an `npx clawhub@latest` command. 4. `npx` downloads or resolves the attacker-controlled mutable r ...[truncated 1261 chars]- Remediation
View remediation
--version --name "" /absolute/path/to/skill-dir ``` 2. Keep the pinned version consistent throughout `SKILL.md`, including the login, identity, publication, inspection, and search examples. 3. Verify the package name, publisher, source repository, and release provenance before updating the pinned version. 4. Prefer installation through a committed lockfile with integrity metadata where the workflow supports it. Use `npm ci` so dependency resolution follows the reviewed lockfile rather than mutable registry tags. 5. In higher-assurance environments, verify package integrity or provenance and use a trusted registry mirror containing approved artifacts. 6. Require explicit user confirmation before the first download or execution of the third-party CLI, not only before publication. 7. Document a controlled upgrade procedure in which each new CLI version is reviewed and tested before changing the pinned version. ]]>