T08 · Insecure Dependencies
- Location
SKILL.md:22- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22 and 41–147
Vulnerability Type: Supply-chain exposure caused by unpinned remote package execution
Risk Level: MediumVulnerable Code
bash npm install -g clawonbash npx clawon discover npx clawon discover --include-memory-db npx clawon discover --include-sessions npx clawon discover --include-secrets npx clawon discover --scanbash npx clawon local backup npx clawon local restore npx clawon local schedule on npx clawon schedule on npx clawon backup npx clawon restoreThe Skill consistently invokes
clawonwithout a pinned package version, cryptographic integrity verification, or an enforced locally reviewed installation.Technical Analysis
npx clawonmay download and execute the version of the package currently published under theclawonnpm package name. The executable payload can therefore change after this Skill has been reviewed. The documentation recommends package verification and local installation, but these measures are optional and are not enforced by the operational instructions.If the npm package, publisher account, release process, or distribution channel is compromised, a malicious package version could execute arbitrary JavaScript with the privileges of the user running the Agent. This is especially sensitive because the declared functionality requires access to OpenClaw workspace data and can optionally process memory databases, chat sessions, credentials, authentication files, API keys, and encryption passphrases.
Scheduled backups write an entry to the user crontab. That persistence is explicitly disclosed, reversible, and necessary for the declared scheduled-backup feature, so it is not independently classified as malicious persistence. However, scheduling increases supply-chain exposure if the resulting task invokes code that is not pinned to a previously reviewed artifact.
...[truncated 1834 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin all documented invocations to a specific reviewed release, for example
npx clawon@REVIEWED_VERSION, rather than resolving the latest available package. - Prefer a locally installed, audited binary and invoke it through an explicit absolute path. Do not permit
npxto download packages automatically during backup or restore operations. - Maintain a lockfile and verify npm integrity metadata or independently published checksums before installation.
- Record the approved package version in the Skill and require explicit review before upgrading it.
- For higher assurance, build the CLI from a pinned source commit or signed release rather than cloning and building an unspecified repository head.
- Configure scheduled tasks to invoke the exact path and reviewed version of the installed executable. The task should not dynamically retrieve or update dependencies.
- Require explicit user confirmation before creating the crontab entry, display the exact entry that will be installed, and continue to provide clear inspection and removal instructions.
- Run the backup utility with the least privileges possible and restrict access to workspace files, API keys, credential files, and passphrase-bearing environment variables.
- Avoid exposing encryption passphrases globally in the cron environment. Use a narrowly scoped secret mechanism with restrictive file permissions where supported.
- Preserve the existing discover-first and opt-in behavior for sessions, memory databases, and secrets, but do not treat secret scanning or encryption as protection against a compromised local executable.
- Pin all documented invocations to a specific reviewed release, for example