T08 · Insecure Dependencies
Error
- Location
- SKILL.md:8
- Finding
- Execution of an Unpinned and Remotely Mutable npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 8 and lines 35-47 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"requires":{"env":["SOCIALDATAX_API_KEY"],"bins":["node","npm"]},"primaryEnv":"SOCIALDATAX_API_KEY","install":[{"kind":"node","package":"socialdatax-skills","bins":[]}],"emoji":"💬","homepage":"https://socialdatax.com/ai?from=clawhub"}} ``` ```bash npx -y socialdatax-skills@latest xhs comments \ --note-id "<note_id>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill xhs-comment-insights npx -y socialdatax-skills@latest xhs comments \ --url "<note_url_or_share_text>" --pretty --source-client socialdatax-skills \ --source-platform clawhub --source-skill xhs-comment-insights npx -y socialdatax-skills@latest xhs sub-comments \ --note-id "<note_id>" --comment-id "<comment_id>" --pretty \ --source-client socialdatax-skills --source-platform clawhub \ --source-skill xhs-comment-insights ``` ### Technical Analysis The Skill directs the Agent to download and execute `socialdatax-skills@latest` from npm. The `latest` tag is mutable and does not identify a specific, previously audited package version. The `-y` option automatically accepts installation without an interactive confirmation step. The project contains neither the package's executable source nor a dependency lockfile or integrity hash. Consequently, the code executed at runtime can differ from the code that existed when the Skill was reviewed. npm package installation may also execute lifecycle scripts before the requested CLI command runs. This is a supply-chain vulnerability rather than evidence that the current package release is malicious. Exploitation requires compromise of the package publisher, npm distribution path, or a future malicious release. ### Attack Path 1. An attacker compromises the npm publisher account, pac ...[truncated 1559 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `socialdatax-skills@latest` with an exact, reviewed version, such as `socialdatax-skills@1.2.3`. Do not use mutable npm tags or version ranges for executable tooling. 2. Commit an npm lockfile and require lockfile-based installation, such as `npm ci`, to preserve the audited dependency graph. 3. Verify package integrity using trusted registry integrity metadata, checksums, signatures, or package provenance before execution. 4. Remove `-y` where practical so unexpected package installation is not silently accepted. 5. Review the pinned package, its transitive dependencies, and npm lifecycle scripts before deployment. 6. Disable npm lifecycle scripts during installation where they are unnecessary, for example by using `--ignore-scripts`, after confirming that the package operates correctly under that restriction. 7. Execute the CLI in a sandbox or container with a minimal environment, read-only filesystem access where possible, and restricted outbound networking. 8. Pass only the required API credential to the child process rather than exposing all Agent environment variables. 9. Establish a controlled update process in which new versions are reviewed, integrity-verified, tested, and explicitly pinned before use. ]]>