T08 · Insecure Dependencies
- Location
references/agent-manual.md:22- Finding
Installation of Unverified Third-Party Plugin Packages
- Content
View full analysis
Vulnerability Details
File Location:
references/agent-manual.md:22-36; the installation workflow is also invoked bySKILL.md:55-57
Vulnerability Type: Supply-chain exposure through unverified package installation
Risk Level: MediumVulnerable Code
bash Preferred install path (README default): openclaw plugins install clawhub:openclaw-cortex-memory openclaw plugins enable openclaw-cortex-memory Fallback install path: npm pack openclaw-cortex-memory@0.1.0-Alpha.34 openclaw plugins install ./openclaw-cortex-memory-0.1.0-Alpha.34.tgz openclaw plugins enable openclaw-cortex-memory rm ./openclaw-cortex-memory-0.1.0-Alpha.34.tgzThe corresponding runtime instruction in
SKILL.md:55-57is:text 1. Check whether plugin `openclaw-cortex-memory` is available. 2. If missing or disabled, run the install bootstrap guide in `{baseDir}/references/agent-manual.md` with README-consistent install order. 3. After plugin is enabled, run memory retrieval or write operations.Technical Analysis
The skill directs the agent to retrieve, install, and enable executable plugin code that is not included in the audited project. Neither installation path requires verification of a cryptographic checksum, package signature, immutable artifact digest, publisher identity, or package contents before enabling the plugin.
The npm fallback specifies a package version, but a version string alone does not establish artifact integrity. Registry compromise, publisher-account compromise, package replacement, or an unsafe package source could cause the downloaded artifact to differ from the code that was originally reviewed. Depending on package and host behavior, package lifecycle or installation logic may also execute during packaging or installation.
This is classified as
T08: Insecure Dependenciesbecause the principal risk is introducing unreviewed executable code through third-party package distrib ...[truncated 1636 chars]- Remediation
View remediation
Remediation Suggestions
- Pin the plugin to an immutable artifact digest rather than relying only on a package name or mutable version.
- Publish an expected SHA-256 or stronger checksum through a separately authenticated channel and verify it before installation.
- Require package-signature verification and document the trusted publisher identity and signing key.
- Download the package without enabling it, inspect its manifest and executable contents, and run automated dependency and malware scans before installation.
- Disable package lifecycle scripts during retrieval or preparation where supported, and review any scripts before allowing execution.
- Require explicit, informed user approval before downloading, installing, or enabling third-party executable code.
- Run the plugin with least privilege in a sandbox that restricts filesystem, credential, process, and network access.
- Provide only narrowly scoped API credentials to the plugin and rotate them if package compromise is suspected.
- Maintain a vetted internal mirror or vendor the reviewed plugin source with the skill so that the installed implementation matches the audited artifact.
- Preserve and validate the package after installation rather than deleting the only local artifact immediately, enabling incident response and reproducibility.