T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned External Skill Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 20-23 **Vulnerability Type**: Unpinned third-party skill installation **Risk Level**: Medium ### Vulnerable Code ```bash clawhub install medici-investments-position-sizer-dv clawhub install medici-investments-pulse-dv ``` ### Technical Analysis The Quick Start instructions install two external skills solely by package name. They do not specify immutable versions, cryptographic hashes, trusted publisher identities, or signature-verification requirements. Consequently, the content installed by these commands can differ from the content originally intended or reviewed. Neither external skill is included in this project, so its instructions, scripts, transitive dependencies, and runtime behavior are outside the audited artifact. This creates a supply-chain trust boundary in which a compromised publisher account, registry entry, or mutable package release could deliver unauthorized content. The issue does not demonstrate that either named package is currently malicious. The vulnerability is the absence of controls that bind installation to a specific, verified artifact. ### Attack Path 1. An attacker compromises the publisher account or registry entry associated with one of the named skills, or otherwise causes a malicious release to be served under that package name. 2. The attacker publishes modified skill instructions, executable scripts, or unsafe dependencies. 3. A user follows the documented Quick Start commands. 4. `clawhub` resolves the unpinned name to the attacker-controlled or unexpectedly modified release. 5. OpenClaw loads or invokes the installed skill. 6. The malicious content can then operate with the tools, files, network access, and other permissions available to that skill in the user's OpenClaw environment. ### Impact Assessment Successful exploitation could alter agent behavior or execute unauthorized operations within the permission ...[truncated 589 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each external skill to an immutable version or content digest rather than installing by a mutable package name alone. 2. Verify package signatures and cryptographic hashes before loading the installed content. 3. Document the expected registry, publisher identity, package version, and integrity value for each dependency. 4. Use lockfiles or an equivalent reproducible dependency manifest when supported. 5. Vendor the referenced skill contents into the reviewed release, or subject every pinned external artifact and its transitive dependencies to a separate security audit. 6. Configure OpenClaw to grant installed skills only the minimum necessary file, network, tool, and execution permissions. 7. Require explicit review and approval before dependency updates are accepted. 8. Pin the documented Python dependencies, `yfinance` and `pandas`, in a dependency manifest with integrity verification if they are required by the external skills.