T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:27
- Finding
- Unpinned Third-Party npm Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7`, `SKILL.md:27-40`, and `SKILL.md:113` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code Dependency installation declaration at line 7: ```yaml metadata: {"openclaw":{"requires":{"env":["SOCIALDATAX_API_KEY"],"bins":["node","npm"]},"primaryEnv":"SOCIALDATAX_API_KEY","install":[{"kind":"node","package":"socialdatax-skills","bins":[]}],"emoji":"🔥","homepage":"https://socialdatax.com/ai?from=clawhub"}} ``` Direct CLI instructions at lines 27-40: ```markdown Prefer the direct CLI when the agent can run shell commands. It does not require MCP server configuration: ```bash npx -y socialdatax-skills@latest douyin hot-search \ --pretty --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-douyin-search npx -y socialdatax-skills@latest douyin search \ --keyword "<keyword>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-douyin-search npx -y socialdatax-skills@latest douyin search \ --keyword "<keyword>" --pages 3 --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-douyin-search ``` ``` Automatic installation guidance at line 113: ```markdown If the current environment has permission, install or restore automatically. ``` ### Technical Analysis The Skill directs the Agent to invoke `npx -y socialdatax-skills@latest`. This command retrieves and executes the package version currently identified by the mutable `latest` npm tag. The package is not pinned to a reviewed version, and the instructions do not require integrity verification, signature validation, or source review. The `-y` option automatically accepts installation prompts, reducing the opportunity for the user or operator to review what will be installed. npm package code and lifecycle scripts execute with the permissions available to the Agent pr ...[truncated 2931 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Pin an exact reviewed version** - Replace `socialdatax-skills@latest` with a specific immutable version, such as `socialdatax-skills@X.Y.Z`. - Update the version only after reviewing and testing the new release. 2. **Verify dependency integrity** - Use a lockfile and verify the package's registry integrity hash. - Where supported, verify package provenance or signatures. - Document the expected package publisher, source repository, and checksum. 3. **Avoid automatic approval** - Remove `-y` from `npx` commands. - Do not instruct the Agent to install or restore dependencies automatically without explicit authorization. 4. **Apply process-level least privilege** - Run the CLI in an isolated container or sandbox. - Supply only `SOCIALDATAX_API_KEY` rather than the Agent's complete inherited environment. - Deny access to browser profiles, SSH configuration, cloud credentials, and unrelated project files. - Use a dedicated low-privilege operating-system account and a read-only filesystem where practical. 5. **Restrict network access** - Allow outbound connections only to documented SocialDataX API endpoints and required npm infrastructure during a separately controlled installation phase. - Separate dependency installation from authenticated API execution so package installation scripts cannot access the API key. 6. **Improve auditability** - Include or link to the exact reviewed source corresponding to the pinned package release. - Document all expected external endpoints, lifecycle scripts, and credential-handling behavior. - Prefer a preinstalled, verified binary or package artifact over runtime retrieval. 7. **Protect credentials** - Use a narrowly scoped API key with usage limits where the service supports it. - Rotate the key if execution of an untrusted or compromised package is suspected. - Avoid exposing unrelated secrets to the CLI process. ]]>