T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:31
- Finding
- Unpinned External Skill Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 31–37 **Vulnerability Type**: Supply-chain exposure through unpinned external skill installations **Risk Level**: Medium **Complete Code Snippet**: ```bash clawhub install analytics-tracking-dv clawhub install autosignals-davinci clawhub install customer-research-dv clawhub install email-automation-dv clawhub install gumroad-page-gen-dv clawhub install testimonial-collector-dv clawhub install first-principles-dv ``` ### Technical Analysis The installation commands retrieve seven external ClawHub skills without specifying immutable versions, commit identifiers, integrity hashes, signatures, publisher identities, or canonical source locations. The audited project does not contain the implementations of these dependencies, so their effective behavior cannot be verified from the local files. Because each command resolves the current registry release at installation time, the installed content may differ from the content that existed when this pack was reviewed. A compromised registry account, package takeover, malicious update, or dependency-name ownership change could therefore deliver attacker-controlled skill instructions or executable components. ### Attack Path 1. An attacker compromises the publisher account, registry entry, or distribution infrastructure for one of the named skills. 2. The attacker publishes a malicious release under the existing dependency name. 3. A user follows the documented Quick Start command without an immutable version or integrity constraint. 4. ClawHub resolves and installs the attacker-controlled current release. 5. When the dependency is loaded or invoked, its instructions or code operate with whatever tools, credentials, files, and network permissions are available to the host agent. This project does not itself demonstrate that any listed dependency is malicious; the finding concerns the absence of controls that bin ...[truncated 803 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every external skill to an immutable, reviewed version or commit identifier rather than resolving the latest release. 2. Record and verify cryptographic hashes or publisher signatures before installation. 3. Document each dependency's verified publisher, canonical source repository, and expected integrity metadata. 4. Vendor the reviewed skill content into the project where licensing permits, enabling complete local inspection and reproducible installation. 5. Establish an allowlist and review process for dependency updates; do not adopt new releases automatically. 6. Run installed skills with least privilege, granting only the files, tools, network destinations, and credentials required for a specific task. 7. Keep email and other service credentials scoped to minimal permissions, and isolate financially sensitive workflows from unrelated skills. 8. Add automated verification that rejects installations when versions, signatures, or hashes do not match the approved dependency manifest.