T08 · Insecure Dependencies
Warning
- Location
scripts/onboarding_wizard.py:353- Finding
Generated Setup Scripts Install Unpinned Third-Party Skills
- Content
View full analysis
Vulnerability Details
File Location:
scripts/onboarding_wizard.py:353-370
Vulnerability Type: Unpinned and insufficiently verified third-party dependencies
Risk Level: Mediumpython all_skills = profile["certainlogic_skills"] + profile.get("community_skills", []) for skill_slug in all_skills: if skill_slug in CERTAINLOGIC_SKILLS: name = CERTAINLOGIC_SKILLS[skill_slug]["name"] cmd = f"clawhub install {CERTAINLOGIC_SKILLS[skill_slug]['clawhub_id']}" elif skill_slug in COMMUNITY_SKILLS: name = COMMUNITY_SKILLS[skill_slug]["name"] cmd = f"clawhub install {COMMUNITY_SKILLS[skill_slug]['clawhub_id']}" else: continue if skill_slug in COMMUNITY_SKILLS: platforms = COMMUNITY_SKILLS[skill_slug].get("platforms", ["linux", "macos"]) if os_name not in platforms: lines.append(f"\n# {name} — skipped: not supported on {os_name}") continue if skill_slug in installed: lines.append(f"\n# {name} — already installed, skipping") else:The generated command is subsequently appended without an exact version or integrity constraint:
python lines.append(f"\necho 'Installing {name}...'") lines.append(f"{cmd} || echo 'WARNING: {name} install failed (may not exist on ClawHub yet)'")Technical Analysis
The setup-script generator identifies dependencies exclusively through mutable ClawHub slugs. The resulting commands do not pin an exact package version, validate a cryptographic hash, verify a package signature, or confirm the publisher’s identity.
The project describes community dependencies as “Verified,” but its
VerificationEngineonly performs structural checks such as the presence and length of `SKIL ...[truncated 1925 chars]- Remediation
View remediation
Remediation Suggestions
- Pin every recommended dependency to an exact reviewed version rather than installing by a mutable slug alone.
- Record and verify cryptographic hashes or signed package manifests before installation.
- Validate the expected publisher identity and reject packages whose ownership or signing identity has changed.
- Download dependencies into a quarantine directory and audit their instructions, scripts, lifecycle hooks, and declared permissions before installation.
- Require explicit per-package confirmation that displays the resolved version, publisher, permissions, and integrity information.
- Fail closed when verification cannot be completed instead of continuing after warnings.
- Replace the unsupported “Verified” label with an accurate description of the checks performed, or implement substantive code and instruction security analysis.
- Generate non-executable checklists by default. Only create executable setup scripts after a clear warning and explicit opt-in.
- Document that structural post-install verification cannot establish package safety or authenticity.