T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:73
- Finding
- Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 73–80 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium The installation instructions retrieve the latest available version of an external npm package without specifying a reviewed version, integrity hash, signature, lockfile, or other immutable verification mechanism. ```markdown ## Install ```bash openclaw plugins install @emotion-machine/claw-messenger ``` The package is published to npm as [`@emotion-machine/claw-messenger`](https://www.npmjs.com/package/@emotion-machine/claw-messenger). You can verify the package contents before installing: ```bash npm pack @emotion-machine/claw-messenger --dry-run ``` ``` ### Technical Analysis The command `openclaw plugins install @emotion-machine/claw-messenger` does not identify a fixed package version. Its effective payload can therefore change whenever the publisher releases a new version or the registry resolves a different release. The suggested `npm pack --dry-run` command only reports which files would be included in the package. It does not authenticate those files, verify that they correspond to reviewed source code, detect malicious lifecycle scripts, or guarantee that the package inspected is the exact artifact later installed. Because the repository contains only `SKILL.md`, neither the plugin implementation nor the referenced `openclaw.plugin.json` manifest was available for local inspection. Consequently, the document's runtime security claims cannot be independently verified from the audited artifact. ### Attack Path 1. An attacker compromises the npm publisher account, package publication workflow, registry artifact, or a future upstream release. 2. The attacker publishes a malicious version under `@emotion-machine/claw-messenger`. 3. A user follows the documented unversioned installation command. 4. The package manager resolves and installs the a ...[truncated 972 chars]
- Remediation
- ## Remediation Suggestions 1. Pin installation instructions to a specific reviewed package version, such as `@emotion-machine/claw-messenger@X.Y.Z`, rather than relying on the registry's current default version. 2. Publish and verify the package's cryptographic integrity hash or signed provenance before installation. 3. Ensure that inspection and installation operate on the same immutable package artifact rather than separately resolving the package name. 4. Review the complete packaged contents, including lifecycle scripts, executable files, transitive dependencies, and the plugin manifest. 5. Include the corresponding plugin source code and `openclaw.plugin.json` manifest in the auditable project or provide a verifiable mapping between the source revision and npm artifact. 6. Use a lockfile or equivalent dependency policy to pin transitive dependencies. 7. Install and run the plugin with least privilege, restricting filesystem, network, credential, and process access to only what its messaging function requires. 8. Establish a controlled update process in which each new version is reviewed and verified before deployment.