T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:29
- Finding
- Unpinned npm Packages Can Execute Mutable Third-Party Code## Vulnerability Details **File Locations**: - `SKILL.md:29-31` - `SKILL.md:335-337` - `README.md:21-23` - `README.md:202-204` - `agents/dev-agent/SOUL.md:197-204` - `agents/dev-agent/SOUL.md:213-218` **Vulnerability Type**: Unpinned package execution and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code `SKILL.md:29-31` and `SKILL.md:335-337`: ```bash npx clawhub install multi-agent-dev-team ``` `README.md:21-23` and `README.md:202-204`: ```bash npx clawhub install multi-agent-dev-team ``` `agents/dev-agent/SOUL.md:197-204`: ```bash # Next.js npx create-next-app@latest project-name # Node.js npm init -y npm install <packages> ``` `agents/dev-agent/SOUL.md:213-218`: ```bash npm install # Install dependencies npm run dev # Start dev server npm run build # Production build npm test # Run tests ``` ### Technical Analysis The documented installation workflow uses `npx` without pinning `clawhub` to an exact, previously reviewed version. The Dev agent is also instructed to execute `create-next-app@latest` and install unspecified packages. `npx` can retrieve a package from the configured npm registry and execute its entry point immediately. The `@latest` tag is mutable and may resolve to different code over time. Similarly, `npm install <packages>` permits the agent to select and install dependencies that were not included in this audit. npm installation may execute package lifecycle hooks such as `preinstall`, `install`, and `postinstall`, giving dependency code execution rights under the agent's operating-system account. The repository itself contains no declared dependencies, package scripts, lockfile, integrity metadata, or package allowlist that would constrain the effective code executed by these commands. Therefore, the reviewed project content does not fully determine the code that will run during installation or generated-project setup. Potential exploitation methods include: 1. Co ...[truncated 2036 chars]
- Remediation
- ## Remediation Suggestions 1. Pin all directly executed tools to reviewed, exact versions: ```bash npx --yes clawhub@<reviewed-exact-version> install multi-agent-dev-team npx --yes create-next-app@<reviewed-exact-version> project-name ``` 2. Remove `@latest` from agent instructions. Upgrade versions only through an explicit review process. 3. Require generated projects to commit and enforce a lockfile, using deterministic installation commands such as: ```bash npm ci ``` 4. Maintain an allowlist of approved package names, versions, registries, and integrity hashes. Do not permit the Dev agent to infer arbitrary dependency names without review. 5. Configure npm to use an explicitly trusted registry and enable provenance or signature verification where supported. 6. Disable lifecycle scripts when they are unnecessary: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are required, inspect the relevant packages and scripts before allowing them to execute. 7. Run package installation in an isolated, least-privileged environment without production secrets, broad filesystem access, inherited SSH agents, or unnecessary network access. 8. Add dependency scanning and lockfile review to the PM agent's acceptance criteria. Reject unexpected package additions, registry changes, Git dependencies, local path dependencies, and install-script changes. 9. Document that credentials should not be exposed to package installation processes and that generated code must undergo human review before being pushed or deployed.