T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:28
- Finding
- Unpinned Remote npm Package Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28–36 **Vulnerability Type**: Unpinned remote dependency retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash npx -y socialdatax-skills@latest xhs user-posts \ --user-id "<user_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill socialdatax-xhs-creator-notes npx -y socialdatax-skills@latest xhs user-posts \ --profile-url "<profile_url_or_share_text>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill socialdatax-xhs-creator-notes ``` The package is also declared without an exact version in the metadata at line 5: ```yaml metadata: {"openclaw":{"requires":{"env":["SOCIALDATAX_API_KEY"],"bins":["node","npm"]},"primaryEnv":"SOCIALDATAX_API_KEY","install":[{"kind":"node","package":"socialdatax-skills","bins":[]}],"emoji":"🗂️","homepage":"https://socialdatax.com/ai?from=clawhub"}} ``` ### Technical Analysis The Skill instructs the Agent to execute `npx -y socialdatax-skills@latest`. The `@latest` selector resolves at invocation time to a mutable npm release rather than to the version reviewed during this audit. The `-y` option suppresses the interactive installation confirmation, allowing the resolved package and its lifecycle behavior to run automatically. Consequently, the effective executable payload can change after the Skill has been reviewed. A compromised package maintainer account, malicious future release, registry compromise, or upstream dependency compromise could introduce arbitrary code. Because the Skill requires `SOCIALDATAX_API_KEY` in its runtime environment, downloaded code may be able to read that credential. Depending on the host sandbox, it may also inherit access to local files, process execution, and unrestricted network connections. The remote API call itself is consistent with the declared creator-note lookup functionality. However, dynamically downloadi ...[truncated 1817 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with an exact, reviewed version, such as `socialdatax-skills@X.Y.Z`. Do not use version ranges or mutable distribution tags. 2. Record the dependency in a committed lockfile and enforce npm integrity hashes during installation. 3. Install dependencies in a controlled build or provisioning phase rather than downloading executable code on each Skill invocation. 4. Remove `-y` from ad hoc installation workflows where practical so unexpected installation is not silently approved. 5. Audit the pinned package, its lifecycle scripts, and its complete transitive dependency tree before deployment. 6. Disable npm lifecycle scripts during installation when they are not required, for example through an appropriately tested `--ignore-scripts` installation policy. 7. Run the CLI in a restricted process or container with: - Read-only or narrowly scoped filesystem access. - Only the required API credential. - No access to unrelated environment variables. - Outbound network access limited to documented SocialDataX API endpoints and the minimum required package infrastructure during provisioning. 8. Keep the API key scoped, rate-limited, rotatable, and separate from unrelated credentials. Rotate it immediately if package compromise is suspected. 9. Pin the metadata installation declaration to the same audited exact version so the documented CLI and platform-managed installation cannot resolve different releases. 10. Establish an update process that reviews and tests each new package version before changing the pin. ]]>