T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Unpinned Third-Party CLI Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:9` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown > `npx clawhub@latest install deepseekoracle/lygo-champion-council` ``` ### Technical Analysis The documented upgrade procedure instructs users to execute the mutable `latest` release of the third-party `clawhub` npm package through `npx`. Depending on the local npm configuration and cache state, `npx` may retrieve the package from a remote registry and execute its CLI with the invoking user's privileges. Because the command does not pin an audited package version or verify a package integrity digest, the code executed in the future may differ from the code available when this skill was reviewed. The command also installs a successor skill whose contents are outside the audited project. A compromised publisher account, package release, registry path, or other supply-chain component could therefore cause attacker-controlled code to run when a user follows the documented instruction. ### Attack Path 1. An attacker compromises the `clawhub` package publisher, its release process, or another relevant supply-chain component. 2. The attacker publishes a malicious release under the mutable `latest` tag. 3. A user follows the upgrade command documented in `SKILL.md`. 4. `npx` retrieves or resolves the malicious package release. 5. The package CLI executes with the permissions of the user running the command. 6. The malicious process may access or modify resources available to that user and may install an unreviewed successor skill. ### Impact Assessment Successful exploitation would provide code execution with the privileges of the invoking user. The accessible scope could include project files, user-readable local data, environment variables exposed to the process, and files writable by that account. The malicious package could also modi ...[truncated 257 chars]
- Remediation
- ## Remediation Suggestions - Replace the mutable `@latest` selector with an exact, reviewed package version. - Verify the package against a documented integrity digest or trusted lockfile before execution. - Document the expected package publisher, registry source, version, and integrity value. - Review the successor skill and its installation behavior before recommending it to users. - Avoid presenting remote package execution as a copy-and-paste upgrade step. Prefer a staged process that downloads or resolves the package, verifies its provenance and integrity, and only then executes it. - Re-audit and deliberately update the pinned version and integrity value whenever an upgrade is required.