T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:20
- Finding
- Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 20-29 **Vulnerability Type**: Unpinned third-party package and skill installation **Risk Level**: Medium ### Vulnerable Code ```bash clawhub uninstall rainman-translate-book clawhub install translate-book ``` Or via npx: ```bash npx skills add deusyu/translate-book -a claude-code -g ``` ### Technical Analysis The migration instructions install externally maintained, mutable content without pinning a package version, repository commit, or verified artifact checksum. The `npx skills` command does not specify an exact version of the `skills` package, so the code resolved and executed by `npx` may change after this skill has been reviewed. The target `deusyu/translate-book` is also not pinned to a reviewed commit. In addition, the `-g` option requests global installation, increasing the scope of the installed content. The ClawHub installation path similarly identifies the replacement skill only by name. The reviewed project contains no lockfile, cryptographic checksum, signature-verification procedure, vendored source, or immutable reference with which to validate the replacement package. This is a supply-chain weakness rather than evidence that the referenced packages are currently malicious. Exploitation depends on compromise or malicious modification of a registry package, distribution account, repository, dependency, or future upstream release. ### Attack Path 1. An attacker compromises or gains publishing control over the `skills` package, the `translate-book` ClawHub entry, the `deusyu/translate-book` repository, or a relevant upstream dependency. 2. The attacker publishes a modified release or changes content resolved by the unpinned installation commands. 3. A user follows the migration instructions in `SKILL.md`. 4. `npx` resolves and executes the mutable package, or ClawHub retrieves the mutable replacement skill. 5. The unreviewed replac ...[truncated 894 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the `skills` npm package to an exact reviewed version instead of relying on the latest registry resolution: ```bash npx skills@<exact-reviewed-version> add deusyu/translate-book@<reviewed-commit> -a claude-code ``` 2. Pin the replacement skill to an immutable, reviewed commit hash or signed release rather than a mutable repository branch or package name. 3. Publish SHA-256 checksums or signed provenance for the expected installation artifacts and require verification before installation. 4. Remove `-g` unless global installation is operationally necessary. Prefer a project-scoped installation with minimal permissions. 5. Review the complete replacement skill and its dependencies before recommending migration. 6. Document the trusted registry, repository owner, expected package version, commit hash, and verification procedure. 7. Where supported, use lockfiles, package-manager integrity metadata, signed releases, and reproducible artifacts to prevent silent upstream changes. 8. Execute installation in a restricted environment without unnecessary credentials or filesystem access.