T08 · Insecure Dependencies
Error
- Location
- scripts/install.sh:7
- Finding
- Unpinned External Skills Create a Supply-Chain Compromise Risk## Vulnerability Details **File Location**: `scripts/install.sh:7-24` **Vulnerability Type**: Unpinned and unverified third-party skill installation **Risk Level**: High The installer downloads six external ClawHub skills using only mutable package slugs. It does not pin versions or cryptographic digests and does not verify package signatures, publisher identities, or downloaded contents. ```bash SKILLS=( "aiotnetwork-account-auth" "aiotnetwork-kyc-identity" "aiotnetwork-card-management" "aiotnetwork-payments-banking" "aiotnetwork-crypto-wallet" "aiotnetwork-blockchain-did" ) echo "Installing ${#SKILLS[@]} AIOT Network skills..." echo "" FAILED=0 SUCCEEDED=0 for slug in "${SKILLS[@]}"; do echo "→ Installing ${slug}..." if clawhub install "${slug}"; then ``` The same unpinned installation approach is documented in `SKILL.md:62-84`, including both the bulk installation script and individual `clawhub install` commands. ### Technical Analysis Package slugs generally identify mutable registry entries rather than immutable, audited artifacts. Consequently, the code installed by this script can change after this project has been reviewed. No control in the supplied project ensures that future installations retrieve the same dependency content that was originally intended. The external skills are responsible for authentication, identity verification, card management, banking, payments, and cryptocurrency operations. Their source code is not present in this project and therefore was outside the available audit scope. This finding does not establish that any current dependency is malicious; it establishes that the installation process provides no protection against a dependency becoming malicious or being replaced. ### Attack Path 1. An attacker compromises a listed ClawHub package, its publisher account, or the relevant registry distribution path. 2. The attacker publishes modified content ...[truncated 1530 chars]
- Remediation
- ## Remediation Suggestions 1. Pin every external skill to an explicitly reviewed, immutable version. 2. Where supported, pin and verify a cryptographic digest for each downloaded artifact. 3. Require valid package signatures and verify that each signature belongs to an allowlisted publisher identity. 4. Fail closed if a version, digest, signature, or publisher check cannot be completed. 5. Maintain a lock file or manifest recording each slug, exact version, digest, publisher, and review date. 6. Audit and test the exact dependency artifacts before allowing them to process identity, payment, card, or cryptocurrency data. 7. Use a trusted internal mirror or vendor reviewed dependency contents when immutable ClawHub installation is unavailable. 8. Run installed skills with least privilege, isolated credentials, restricted filesystem and network access, and explicit approval for sensitive transactions. 9. Add automated dependency monitoring and require security review before changing any pinned version or digest.