T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:25
- Finding
- Unpinned External Skill Installation Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 25–28 **Vulnerability Type**: Supply-chain risk from mutable, externally distributed skill dependencies **Risk Level**: Medium ```bash ```bash clawhub install medici-investments-position-sizer-dv clawhub install medici-investments-pulse-dv ``` ``` ### Technical Analysis The documented installation commands retrieve two external skills by package name without specifying an immutable version, content hash, verified source repository, or publisher identity. Neither external skill is included in the audited project, so its implementation and effective instructions cannot be reviewed from the supplied files. Because package names can resolve to content that changes after this project has been audited, users may install code or agent instructions different from those originally intended. A compromised registry account, namespace takeover, malicious package update, or repository compromise could therefore turn either dependency into a supply-chain delivery channel. This finding does not establish that the named packages are currently malicious. It identifies the absence of controls needed to ensure that future installations retrieve the same reviewed content. ### Attack Path 1. An attacker compromises the publisher account, registry infrastructure, or release process for one of the named external skills, or otherwise gains control of the corresponding package namespace. 2. The attacker publishes a modified release containing malicious scripts or agent instructions. 3. A user follows the Quick Start commands in `SKILL.md`. 4. ClawHub resolves the unpinned package name to the attacker-controlled release. 5. The downloaded skill is loaded or invoked with the permissions available to the user's agent environment. 6. The malicious release can perform actions permitted by that environment, potentially including accessing agent-visible data, invoking enabled tools, mo ...[truncated 701 chars]
- Remediation
- ## Remediation Suggestions 1. Pin each external skill to a reviewed, immutable version rather than installing the latest release by package name alone. 2. Where supported, verify downloads using cryptographic content hashes or signed release metadata. 3. Document the expected publisher identity and canonical source repository for each dependency. 4. Vendor the reviewed skill contents into the project when licensing and maintenance constraints permit. 5. Add a review step that inspects downloaded scripts, manifests, and instructions before activation. 6. Run third-party skills with least privilege, restricting filesystem access, credentials, enabled tools, and outbound network connectivity. 7. Use dependency monitoring and an approved-version policy so updates are not adopted automatically without security review.