T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:31
- Finding
- Unpinned Third-Party CLI Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 31 and lines 41–42 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium The Skill declares and recommends installation of `mineru-open-api` without a fixed, reviewed version. The Go installation explicitly selects `@latest`, and the npm command installs an unspecified version globally. ```yaml metadata: {"openclaw":{"emoji":"📄","requires":{"bins":["mineru-open-api"],"env":["MINERU_TOKEN"]},"primaryEnv":"MINERU_TOKEN","install":[{"id":"npm","kind":"node","package":"mineru-open-api","bins":["mineru-open-api"],"label":"Install via npm"},{"id":"go","kind":"go","package":"github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api","bins":["mineru-open-api"],"label":"Install via go install","os":["darwin","linux"]}]}} ``` ```bash npm install -g mineru-open-api go install github.com/opendatalab/MinerU-Ecosystem/cli/mineru-open-api@latest ``` ### Technical Analysis Package references without exact versions are mutable. Each installation can resolve to a different release from the npm registry or the upstream Go repository. The Go command explicitly requests the latest available revision, while npm resolves the current registry version because no version is specified. If the package publisher account, source repository, release process, or distribution registry is compromised, a malicious release could be delivered after the Skill has already been reviewed. Package installation or subsequent CLI execution could then run attacker-controlled code. The global npm installation increases exposure by placing the executable in a shared command path rather than isolating it to a project-specific environment. No evidence establishes that the currently referenced package is malicious. The confirmed issue is the unsafe, non-reproducible dependency installation mechanism. ### Attack Path 1. An attacker compromises the dependency publisher, ...[truncated 1155 chars]
- Remediation
- ## Remediation Suggestions 1. Pin both installation methods to exact, reviewed versions instead of relying on the current registry version or `@latest`. 2. Record and verify cryptographic checksums, signed release artifacts, package provenance, or registry integrity metadata before installation. 3. Prefer project-local npm installation or an isolated container/environment over global installation. 4. Review new releases before updating pinned versions, including dependency changes and installation lifecycle scripts. 5. Execute the converter with least privilege and expose only the input and output paths required for conversion. 6. Avoid installing dependencies from an elevated shell unless strictly necessary. 7. Document the trusted publisher and canonical release source so similarly named or substituted packages are not accepted.