T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:43
- Finding
- Unpinned npx Installer Executes a Mutable Third-Party Package## Vulnerability Details **File Location**: `SKILL.md:43`, `SKILL.md:96`, and `README.md:8` **Vulnerability Type**: Supply-chain risk through an unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:43`: ```markdown **Install:** `npx clawhub@latest install deepseekoracle/lygo-tv` ``` `SKILL.md:96` and `README.md:8`: ```bash npx clawhub@latest install deepseekoracle/lygo-tv ``` ### Technical Analysis The documented installation command invokes `npx` with the mutable `clawhub@latest` tag. If the requested package is not already available locally, `npx` can download and execute package code from the configured npm registry. The `latest` tag can be changed after this Skill has been reviewed. Consequently, the code executed by users is not necessarily the version that existed when the repository was audited. The command also provides no package-integrity validation, cryptographic signature verification, or trusted version constraint. The command is documentation and is not automatically executed by the included Python scripts. Exploitation therefore requires a user or agent to follow the installation instructions. ### Attack Path 1. An attacker compromises the upstream `clawhub` npm package, its publisher account, registry distribution process, or another component capable of changing the package associated with `latest`. 2. The attacker publishes a malicious release and assigns the `latest` tag to it. 3. A user or agent follows the installation command from `SKILL.md` or `README.md`. 4. `npx` resolves `clawhub@latest` to the attacker-controlled release and downloads it. 5. npm lifecycle behavior or the invoked CLI entry point executes the malicious package under the invoking user's account. 6. The payload can perform any operation permitted to that account, independently of the `network: false`, `subprocess: false`, and filesystem restrictions declared for this Skill's own Python ...[truncated 705 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `clawhub@latest` with an explicitly reviewed version, for example: ```bash npx --yes clawhub@<audited-exact-version> install deepseekoracle/lygo-tv ``` 2. Publish and verify the expected npm integrity digest or package signature before execution. Document a reproducible procedure for comparing the downloaded package against the approved artifact. 3. Commit a lockfile where the surrounding distribution model supports one, and use deterministic installation commands such as `npm ci`. 4. Avoid executing newly downloaded packages directly where possible. Download the package first, inspect its metadata and lifecycle scripts, verify its checksum, and execute it only after validation. 5. Run installation in a minimally privileged, isolated environment without production credentials, sensitive environment variables, or unnecessary filesystem access. 6. Update every occurrence in `SKILL.md` and `README.md` so users are not directed back to the mutable command.