T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:73
- Finding
- Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 73–81 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Install ```bash openclaw plugins install @emotion-machine/claw-messenger ``` The package is published to npm as [`@emotion-machine/claw-messenger`](https://www.npmjs.com/package/@emotion-machine/claw-messenger). You can verify the package contents before installing: ```bash npm pack @emotion-machine/claw-messenger --dry-run ``` ``` ### Technical Analysis The installation command identifies the npm package only by name and does not pin an exact reviewed version or package integrity digest. Consequently, the package resolved when a user runs the command may differ from the package that existed when this Skill was audited. The suggested `npm pack --dry-run` command lists files that would be included in the currently resolved package, but it does not establish that the package is trustworthy. It does not pin the artifact, verify correspondence with reviewed source code, audit its implementation, or prevent a subsequently published version from being installed. The audited project contains only `SKILL.md`; it does not include the plugin source, package lockfile, package manifest, or integrity metadata. Therefore, claims about the installed plugin's runtime behavior cannot be independently verified from the submitted artifact. ### Attack Path 1. An attacker compromises the npm publisher account, package publication process, source repository release workflow, or another component of the package supply chain. 2. The attacker publishes a malicious release under the legitimate `@emotion-machine/claw-messenger` package name. 3. A user follows the documented command without an exact version: `openclaw plugins install @emotion-machine/claw-messenger`. 4. The installer resolves and installs the malicious release. ...[truncated 829 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installation command to an exact version that has undergone security review, for example: ```bash openclaw plugins install @emotion-machine/claw-messenger@X.Y.Z ``` 2. Publish and verify a cryptographic integrity digest for the reviewed package artifact. 3. Include or link to the exact source revision corresponding to the published npm package, along with reproducible build instructions. 4. Review the package manifest, implementation, transitive dependencies, and lifecycle scripts before recommending installation. 5. Use a lockfile or equivalent dependency resolution mechanism wherever the OpenClaw plugin installer supports one. 6. Configure automated dependency and provenance checks, including npm provenance verification and publisher-account protections. 7. Require a new security review before changing the pinned package version. 8. Run the plugin with least privilege and restrict its filesystem and network access to the configuration and relay endpoint required for its declared purpose.