T08 · Insecure Dependencies
Warning
- Location
SKILL.md:10- Finding
Execution of an Unverified Third-Party npm Dependency
- Content
View full analysis
``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.0`). Review the GitHub source before installing. ``` From `SKILL-cn.md`: ```yaml 'requires': { 'bins': ['npm', 'npx'] }, 'install': 'npm install -g @dlazy/cli@1.2.0', 'installAlternative': 'npx @dlazy/cli@1.2.0', ``` ```markdown - **npm 包名**: `@dlazy/cli`（本技能 install 字段固定到 `1.0.9` 版本） - **官网**: [dlazy.com](https://dlazy.com) 如果你不希望在系统上长期保留一个全局 CLI，可以按需运行： ```bash npx @dlazy/cli@1.2.0 ``` 如选择全局安装，技能的 `metadata.clawdbot.install` 字段已固定到 `npm install -g @dlazy/cli@1.2.0`。安装前建议先到 GitHub 仓库审阅源码。 ``` ### Technical Analysis The Skill directs the agent or user to retrieve and execute `@dlazy/cli@1.2.0` from the npm registry. The dependency's implementation is not included in the audited project, and the project provides no lockfile, package integrity hash, signature verification, or vendored source against which the downloaded package can be validated. Pinning a version reduces unintended upgrades but does not independently verify package integrity or publisher trust. Both `npm install` and `npx` may execute package code and npm lifecycle scripts locally. A global installation also increases persistence and makes the executable available to later sessions. The documentation contains a ...[truncated 2438 chars]- Remediation
View remediation