T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🎓","requires":{"bins":["npm","npx"],"env.optional":["DLAZY_API_KEY"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://dlazy.com","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, read the 露脸预算 section of SKILL.md before quoting any cost, and read recipes.md before writing any base-portrait prompt. Run `dlazy <model> -h` to confirm current flags before building a command."}} ``` ### Technical Analysis The Skill instructs users to install the external npm package `@dlazy/cli@1.2.3` globally or execute it directly through `npx`. The dependency's implementation is not included in the audited project, so its behavior could not be reviewed as part of this audit. Pinning the package version limits ordinary version drift, but the instructions do not provide a cryptographic integrity value, verified package provenance, or a lockfile. Both npm installation and `npx` execution may run package lifecycle scripts and package-controlled code. A global installation also increases the affected scope by placing executables in the user's global npm environment. The CLI is functionally relevant to the declared media-generation workflow. However, executing an externally retrieved package without integrity validation exceeds the minimum assurance needed for that functionality and creates a supply-chain trust boundary. ### Attack Path 1. An attacker compromises the package publisher account, package distribution infrastructure, or the referenced package release. 2. The attacker introduces malicious package code or a malicious npm lifecycle script into the distributed artifact. 3. A user follows the Skill metadata and runs ...[truncated 1308 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Provide verifiable integrity information** - Publish the exact expected package tarball digest. - Document a verification command that checks the downloaded artifact before execution. - Use npm lockfile integrity metadata where installation is managed through a project. 2. **Publish and verify package provenance** - Enable npm package provenance backed by the release build system. - Link the package to a public source repository and reproducible release process. - Sign release artifacts where supported. 3. **Avoid global installation** - Prefer a project-local, pinned development dependency. - Invoke the locally installed binary through a package script. - This limits modification of the user's global npm environment. 4. **Restrict lifecycle scripts** - Where compatible, install with lifecycle scripts disabled: ```bash npm install --ignore-scripts --save-exact @dlazy/cli@1.2.3 ``` - If lifecycle scripts are required, document each required script and explain why it is necessary. 5. **Use an isolated execution environment** - Run the CLI in a container, sandbox, or dedicated low-privilege account. - Mount only the files explicitly needed for the media-generation task. - Do not expose unrelated home-directory contents or credentials. 6. **Minimize credential exposure** - Supply `DLAZY_API_KEY` only to the specific process that requires it. - Use a scoped and revocable API key with spending limits where supported. - Avoid storing reusable credentials in broadly accessible plaintext configuration files. 7. **Control outbound access** - Restrict network access to the documented endpoints required by the workflow. - Review privacy and retention terms before uploading confidential course documents or media. ]]>