T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:35
- Finding
- Unpinned External Skill Dependencies Installed from a Mutable Registry## Vulnerability Details **File Location**: `SKILL.md`, lines 35-43 **Vulnerability Type**: Unpinned and unaudited third-party skill dependencies **Risk Level**: Medium ```bash clawhub install analytics-tracking-dv clawhub install autosignals-davinci clawhub install customer-research-dv clawhub install email-automation-dv clawhub install gumroad-page-gen-dv clawhub install testimonial-collector-dv clawhub install first-principles-dv ``` ### Technical Analysis The project does not include the implementations of its seven advertised skills. Instead, it directs users to install external skills from ClawHub using package names alone. The commands do not specify immutable versions, content hashes, verified publisher identities, canonical source repositories, or expected permissions. Because registry names are mutable resolution points, the content installed when a user executes these commands may differ from the content reviewed in this package. This creates a supply-chain trust gap: compromise of a publisher account, package replacement, ownership transfer, or dependency-confusion or typosquatting conditions could cause attacker-controlled skill instructions or code to be installed. The implementations of the advertised analytics, trading, scraping, email, sales-page, and testimonial capabilities are absent from the audited project. Their behavior, permissions, data handling, and security properties therefore cannot be validated from this package. ### Attack Path 1. A user trusts the Business Tools Pack and follows its Quick Start instructions. 2. The user executes one or more unpinned `clawhub install` commands. 3. ClawHub resolves the package name to the version currently available from the external registry. 4. An attacker compromises, replaces, takes over, or imitates one of the referenced packages. 5. The attacker-controlled dependency is installed without an integrity check against a version reviewed with this ...[truncated 884 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every external skill to an immutable version or content-addressed digest. 2. Publish expected cryptographic hashes and verify downloaded content before installation or execution. 3. Identify each package's verified publisher and canonical source repository. 4. Vendor the reviewed skill implementations into the release where practical, or provide reproducible lock files covering the full dependency graph. 5. Audit every referenced skill and its transitive dependencies before recommending installation. 6. Document the permissions, network destinations, filesystem access, credentials, and data categories required by each skill. 7. Require explicit user confirmation before granting access to email platforms, customer data, analytics systems, or financial and trading resources. 8. Run third-party skills under least privilege, with isolated credentials, restricted filesystem access, and destination allowlisting. 9. Add automated publisher, signature, version, and integrity verification to the installation workflow and fail closed when verification cannot be completed.