T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5,56-63`; duplicated in `SKILL-cn.md:5,56-63` **Vulnerability Type**: Third-party package installation and execution without artifact integrity verification **Risk Level**: Medium ### Complete Code Snippet ```bash npx @dlazy/cli@1.2.3 <command> ``` ```markdown Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The corresponding metadata declares: ```json { "install": "npm install -g @dlazy/cli@1.2.3", "installAlternative": "npx @dlazy/cli@1.2.3" } ``` ### Technical Analysis The Skill depends on an external npm package, `@dlazy/cli@1.2.3`, whose executable source and transitive dependencies are not included in the audited project. Both documented installation methods cause code obtained from the npm registry to run locally: - `npx` can download and immediately execute the package. - `npm install -g` installs the package globally and may execute package lifecycle scripts during installation. Pinning the package version reduces unintended version drift, but it does not independently verify the downloaded artifact's integrity or the safety of its transitive dependencies. The project does not provide a lockfile, integrity hash, vendored dependency tree, or locally reviewable implementation corresponding to the executable package. This creates a supply-chain trust boundary. If the package artifact, publisher account, npm registry delivery path, or a transitive dependency is compromised, attacker-controlled code could execute under the privileges of the user invoking the Skill. No evidence in the audited files establishes that the named package is currently malicious. The finding concerns the unsafe dependency execution model and absence of verifiable dependency integrity controls. ### Attack Path 1. An attacker compromises the npm publisher ...[truncated 1457 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid global installation and prefer an isolated, non-privileged execution environment. 2. Vendor the reviewed implementation and exact dependency tree into a controlled build process where licensing permits. 3. Provide a lockfile containing exact transitive versions and registry integrity hashes. 4. Verify downloaded package artifacts against a separately published cryptographic digest or signed provenance record before execution. 5. Use npm provenance and package-signing verification where supported. 6. Disable package lifecycle scripts during installation when they are not required, for example by using `--ignore-scripts`, after confirming that this does not break legitimate operation. 7. Run the CLI inside a sandbox or container with: - No elevated privileges. - A minimal environment-variable allowlist. - Access only to explicitly selected input and output files. - Network access restricted to the documented endpoints. - No access to unrelated credential stores or home-directory content. 8. Store the API key in an operating-system credential manager rather than a plaintext user configuration file where feasible. 9. Review and pin every transitive dependency, not only the top-level CLI version. 10. Document the expected package digest and a repeatable procedure for verifying that the installed executable corresponds to the reviewed source revision. ]]>