T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution and Global Installation of an Unverified Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:59`, and `SKILL.md:62` **Vulnerability Type**: Third-party dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy banana-pro -h for help."}} ``` `SKILL.md:59`: ```bash npx @dlazy/cli@1.2.3 <command> ``` `SKILL.md:62`: ```markdown Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The equivalent installation and execution instructions are also present in `SKILL-cn.md:5`, `SKILL-cn.md:59`, and `SKILL-cn.md:62`. ### Technical Analysis The Skill instructs the host to retrieve and execute `@dlazy/cli@1.2.3` from the npm registry. The executable implementation of that package is not included in the audited project, so its lifecycle scripts, runtime behavior, credential handling, filesystem access, and network activity cannot be verified from the supplied artifact. Pinning the dependency to version `1.2.3` reduces unintended version drift, but it does not provide cryptographic verification of the retrieved package artifact. There is no lockfile, trusted package hash, vendored source, or verified release signature in the project. Both documented installation paths cross a remote code-execution trust boundary: - `npx` downloads and executes package code on demand. ...[truncated 1864 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the required CLI implementation or include its auditable source in the Skill package rather than downloading executable code at invocation time. 2. Verify the exact npm artifact using a trusted lockfile and integrity hash, and validate the published package against a reviewed source revision. 3. Prefer a reviewed local installation over automatic `npx` execution, which can retrieve code immediately before running it. 4. Avoid global installation. Install the dependency in an isolated project directory or disposable container with minimum privileges. 5. Disable npm lifecycle scripts during installation where compatible, for example by using `npm install --ignore-scripts`, and separately review any scripts that are operationally required. 6. Run the CLI with restricted filesystem and network access. Limit file access to explicitly selected input and output paths and network access to documented service endpoints. 7. Supply API credentials only for the duration of the command. Protect `~/.dlazy/config.json` with user-only permissions and rotate the API key if package compromise is suspected. 8. Maintain dependency provenance records, monitor the pinned release and its transitive dependencies for compromise, and require security review before changing the pinned version.