T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Mutable Third-Party Installer Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 9 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown > **Consolidated (Δ9 v2):** New installs → `lygo-champion-council`. This slug is legacy retention only. > `npx clawhub@latest install deepseekoracle/lygo-champion-council` ``` ### Technical Analysis The migration instructions recommend executing `clawhub` through `npx` using the mutable `latest` tag. This resolves and runs a third-party npm package version at execution time rather than a version reviewed alongside this project. The command also installs a separately maintained successor Skill whose contents are not present in the audited package. Consequently, the effective installation behavior can change after this project has been reviewed. Compromise of the package publisher, registry entry, distribution channel, or successor Skill could expose users to altered installer code or malicious Skill content. The audited project does not establish that the current upstream package is malicious; the vulnerability is the unpinned trust relationship and unsafe dependency-execution pattern. ### Attack Path 1. An attacker compromises the `clawhub` publishing account, npm package, registry resolution path, or successor Skill distribution account. 2. The attacker publishes a modified release that becomes the target of the mutable `latest` tag or replaces the successor Skill content. 3. A user follows the migration command from `SKILL.md`. 4. `npx` downloads and executes the unreviewed package release. 5. The compromised installer or installed Skill performs attacker-controlled actions with the permissions of the invoking user. ### Impact Assessment Successful exploitation could execute attacker-controlled installer behavior under the invoking user's account. The resulting scope depends on the runtime environment and user permissions, potential ...[truncated 313 chars]
- Remediation
- ## Remediation Suggestions - Replace `clawhub@latest` with an exact, reviewed package version. - Pin the successor Skill to an immutable version, release digest, or cryptographic content hash. - Publish the expected SHA-256 digest and require verification before installation. - Prefer a lockfile-backed installation workflow with integrity metadata. - Document the exact package source and trusted publisher identity. - Avoid directly executing remotely resolved packages where possible; download, verify, inspect, and then run the installer. - Re-audit both the pinned installer version and the successor Skill before recommending them to users. - Add a warning that the migration command executes third-party code with the invoking user's permissions.