T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Package Execution and Remote Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 8–9 **Vulnerability Type**: Unpinned third-party package execution and mutable remote Skill installation **Risk Level**: Medium **Complete Code Snippet**: ```markdown > **Consolidated (Δ9 v2):** New installs → `lygo-champion-council`. This slug is legacy retention only. > `npx clawhub@latest install deepseekoracle/lygo-champion-council` ``` ### Technical Analysis The documented command uses `npx` to resolve and execute the latest published version of the `clawhub` npm package. The package version is not pinned, and the remotely installed `deepseekoracle/lygo-champion-council` Skill is not constrained by an immutable version, cryptographic digest, or verified signature. Therefore, the effective code and Skill instructions executed by a user can change after this repository has been audited. Compromise of the npm package, its publisher account, the package registry, or the remote Skill publisher could turn the recommended command into a supply-chain delivery mechanism. The audited repository does not itself contain a malicious payload; the risk arises when a user follows this mutable installation instruction. ### Attack Path 1. An attacker compromises the `clawhub` npm package, its publisher account, or the remote successor Skill. 2. The attacker publishes a malicious release or replaces the remotely resolved Skill content. 3. A user or agent follows the command in `SKILL.md`. 4. `npx` downloads and executes the then-current `clawhub@latest` package. 5. The package installs the remotely resolved `deepseekoracle/lygo-champion-council` Skill. 6. Attacker-controlled package code may execute locally, or attacker-controlled Skill instructions may be loaded in subsequent agent activity. ### Impact Assessment Package code launched through `npx` runs with the privileges of the invoking user. Depending on the malicious upstream payload and loc ...[truncated 411 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `clawhub@latest` with an exact, reviewed package version. 2. Pin the successor Skill to an immutable version or content digest. 3. Publish expected SHA-256 digests or signed provenance and verify them before installation. 4. Use lockfiles and integrity metadata where supported. 5. Prefer downloading the package and Skill into an isolated location for review before executing or activating them. 6. Run installation with least privilege in a sandbox or disposable environment. 7. Document the trusted publisher identity and a procedure for verifying signatures, hashes, and provenance. 8. Periodically review pinned versions before intentionally upgrading them.