T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:8
- Finding
- Unpinned Remote Package Execution and External Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 8–9 **Vulnerability Type**: Unpinned third-party dependency and mutable remote installation **Risk Level**: Medium ### Vulnerable Code ```markdown > **Consolidated (Δ9 v2):** New installs → `lygo-champion-council`. This slug is legacy retention only. > `npx clawhub@latest install deepseekoracle/lygo-champion-council` ``` ### Technical Analysis The documented installation command instructs users to execute `clawhub@latest` through `npx`. The `latest` tag is mutable and does not identify a specific audited release or cryptographic digest. Depending on the local npm cache and configuration, `npx` can retrieve the referenced package from a remote registry and immediately execute its CLI with the invoking user's privileges. The command then installs the separately maintained `deepseekoracle/lygo-champion-council` skill, whose contents are outside this project's audited files. Neither the CLI nor the successor skill is pinned to an immutable version or integrity value. Consequently, the code and instructions ultimately executed can change after this package has been reviewed. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the relevant registry resolution path, or the externally maintained successor skill. 2. The attacker publishes a malicious version selected by `clawhub@latest`, or replaces the successor skill's mutable content. 3. A user follows the installation command in `SKILL.md`. 4. `npx` downloads and executes the changed CLI without ensuring that it is the version previously audited. 5. The CLI or installed skill executes malicious code or introduces unsafe instructions in the user's environment. ### Impact Assessment Malicious code executed by the downloaded CLI could act with the operating-system permissions of the user running `npx`. Depending on those permissions and the behavior of the compromised dependency, t ...[truncated 517 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `clawhub@latest` with an exact, reviewed package version. 2. Enforce npm integrity verification through a lockfile, verified package digest, or equivalent immutable provenance mechanism. 3. Pin the successor skill to an immutable release identifier or content digest rather than a mutable name alone. 4. Document the expected publisher identity, package digest, and verification procedure. 5. Prefer downloading and inspecting the package before execution instead of immediately running newly fetched code through `npx`. 6. Execute installation with least privilege in a sandbox or otherwise restricted environment. 7. Re-audit both the pinned CLI release and successor skill whenever either pinned version is intentionally upgraded.