T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:24
- Finding
- Unpinned External Skill Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 24–25 **Vulnerability Type**: Unpinned third-party skill installation **Risk Level**: Medium ```bash clawhub install monet-works-content-qa-dv clawhub install ogilvy-humanizer-dv ``` ### Technical Analysis The Quick Start instructions install two third-party ClawHub skills by package name without specifying immutable versions, cryptographic digests, verified source locations, or integrity checks. Neither dependency's implementation is included in this repository, so its effective instructions and executable behavior cannot be reviewed from the audited artifact. Because package names resolve to mutable registry content, future releases or compromised package entries could differ from the versions originally intended by the project author. This creates a supply-chain trust boundary between the reviewed documentation and the code or instructions ultimately installed. ### Attack Path 1. An attacker compromises a maintainer account, registry entry, publication pipeline, or another distribution component for either named skill. 2. The attacker publishes a modified package under the expected package name. 3. A user follows the documented Quick Start commands. 4. ClawHub resolves and installs the current mutable package because no immutable version or digest is specified. 5. The malicious package is loaded or invoked with the permissions available to the host agent. 6. Its resulting capabilities depend on the installed package and host configuration, and could include unauthorized file, network, tool, or agent-context access. ### Impact Assessment The immediate project contains no executable implementation, so no direct malicious behavior is established. The potential impact originates from the externally resolved dependencies. If one is compromised, its payload may operate with the invoking agent's permissions and affect content, accessible files, network resources, tool calls, or session behavior ...[truncated 125 chars]
- Remediation
- ## Remediation Suggestions - Pin each dependency to an immutable, reviewed version and preferably a cryptographic digest. - Document the authoritative registry namespace, publisher identity, and expected integrity value. - Verify signatures or checksums before installation and reject mismatches. - Vendor reviewed dependency contents into the project when practical so the complete behavior can be audited. - Use a lock file or equivalent reproducible dependency manifest if supported by ClawHub. - Re-audit dependencies before updating pinned versions. - Run installed skills with least privilege, restricting filesystem, network, credential, memory, and tool access to the minimum required. - Add installation guidance warning users not to accept unexpected publisher changes or unresolved package substitutions.