T08 · Insecure Dependencies
Warning
- Location
clawwork_checkin.py:262- Finding
Unverified Dependency Discovery and Execution
- Content
View full analysis
Vulnerability Details
File Location:
clawwork_checkin.py:262-275, 374-385, 500-511
Vulnerability Type: Unverified third-party dependency execution
Risk Level: MediumVulnerable Code
python # Current directory (skill next to this one) possible_paths.append(os.path.join(SCRIPT_DIR, "..", "learning-checkin")) possible_paths.append(os.path.join(SCRIPT_DIR, "..", "learning_checkin")) # Parent of parent possible_paths.append(os.path.join(SCRIPT_DIR, "..", "..", "learning-checkin")) # Look in active_skills if "OPENCLAW_DIR" in os.environ: possible_paths.append(os.path.join(os.environ["OPENCLAW_DIR"], "active_skills", "learning-checkin")) # Check if learning_checkin.py exists in any of these paths for path in possible_paths: check_file = os.path.join(path, "learning_checkin.py") if os.path.exists(check_file): return True, pathThe discovered dependency is executed by the
checkincommand:python checkin_script = os.path.join(path, "learning_checkin.py") import subprocess try: proc = subprocess.run( [sys.executable, checkin_script, "checkin"], capture_output=True, text=True, timeout=10, encoding="utf-8", errors="ignore" )The same dependency is executed by the
statuscommand:python checkin_script = os.path.join(path, "learning_checkin.py") import subprocess try: proc = subprocess.run( [sys.executable, checkin_script, "status"], capture_output=True, text=True, timeout=10, encoding="utf-8", errors="ignore" )Technical Analysis
The application considers any file named
learning_checkin.pyin one of several searched locations to be a trusted dependency. The only validation isos.path.exists; the code does not verify the file's cryptographic hash, signature, package identity, ownership, permissions, or provenance.The search includes parent-relative directories and a location der ...[truncated 1811 chars]
- Remediation
View remediation
Remediation Suggestions
- Resolve the dependency exclusively through a trusted skill registry or a single administrator-controlled installation root instead of probing parent directories.
- Canonicalize both the approved root and candidate path with
os.path.realpath, then verify that the candidate remains inside the approved root. - Pin an audited dependency version and validate a signed manifest or trusted cryptographic hash before every execution.
- Reject symbolic links and non-regular files. Where supported, verify that the dependency and its parent directories have trusted ownership and are not writable by untrusted users.
- Do not derive executable dependency locations directly from an untrusted environment variable. If
OPENCLAW_DIRis required, validate it against trusted configuration established outside the skill process. - Install the dependency only through an explicit, user-approved workflow that verifies package identity and provenance.
- Fail closed when validation cannot be completed; do not execute a candidate merely because its filename exists.
- Consider running the dependency in a restricted subprocess environment with minimized inherited variables, filesystem permissions, and network access.