T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Third-Party Package Execution and Successor Installation## Vulnerability Details **File Location**: `SKILL.md`, line 8 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```text > `npx clawhub@latest install deepseekoracle/lygo-champion-council` ``` ### Technical Analysis The documented migration command instructs users to execute the mutable `latest` release of the third-party `clawhub` npm package. It then installs a successor Skill whose contents are not included in this repository and were therefore outside the audited codebase. The `latest` tag is not immutable. Its resolved package contents can change after this Skill has been reviewed. The command does not pin a package version, enforce a package integrity digest, identify an expected successor artifact hash, or require review before activation. Consequently, the effective code and Skill instructions executed by users may differ from those covered by this audit. This constitutes an unsafe supply-chain boundary. It is not evidence that the current external packages are malicious, but the installation method creates exposure if the npm package, publishing account, registry resolution, or successor Skill is compromised or unexpectedly changed. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, its dependency chain, or another relevant distribution component. 2. The attacker publishes a modified release and causes the mutable `latest` tag to resolve to it. 3. A user follows the migration command in `SKILL.md`. 4. `npx` downloads and executes the package resolved by `clawhub@latest`. 5. The downloaded package can run with the invoking user's privileges and install an unaudited successor Skill. 6. Malicious executable behavior or instructions may then affect the local environment or Agent. ### Impact Assessment Successful exploitation could permit code supplied through the package distribution chain to execute with the privileges of the user running `npx`. The resu ...[truncated 533 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `clawhub@latest` with a specific, reviewed package version. 2. Pin and verify the npm package integrity value through a lockfile or equivalent immutable integrity control. 3. Publish and validate the expected cryptographic digest or signed provenance of the successor Skill before installation. 4. Review the complete successor Skill, including its scripts, dependencies, hooks, and instructions, before activation. 5. Avoid automatically trusting or enabling the installed Skill merely because installation completed successfully. 6. Run installation with the minimum required privileges in an isolated environment where practical. 7. Document a controlled upgrade process that requires explicit review whenever the package version or successor artifact digest changes.