T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Unverified Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Third-party dependency and software supply-chain risk **Risk Level**: Medium ### Vulnerable Code Snippet ```yaml metadata: {"clawdbot":{"emoji":"🛍️","requires":{"bins":["npm","npx"],"env.optional":["DLAZY_API_KEY"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://dlazy.com","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, read recipes.md before writing any base-portrait prompt, and run `dlazy <model> -h` to confirm current flags before building a command."}} ``` ### Technical Analysis The skill directs users to install the third-party package `@dlazy/cli@1.2.3` globally or execute it directly through `npx`. The project does not contain the package source, a cryptographic checksum, a verified signature, or other integrity material that would allow the dependency to be reviewed and authenticated as part of this audit. Pinning the dependency to version `1.2.3` reduces unintended version drift, but it does not protect against compromise of the npm registry entry, publisher account, or published artifact. npm installation can execute package lifecycle scripts, while `npx` can download and run the package without a separate review step. The global installation option also places package binaries in the user's global npm environment. This is a supply-chain exposure rather than evidence that the identified package is currently malicious. The risk becomes exploitable if the referenced package artifact or its dependency tree is compromised. ### Attack Path 1. An attacker compromises the npm publisher account, registry artifact, or a transitive dependency associated with `@dlazy/cli@1.2.3`. 2. The attacker introduces malicious package code or an npm lifecycle script into the distributed artifact. 3. A user follows the ...[truncated 1196 chars]
- Remediation
- ## Remediation Suggestions 1. **Provide verifiable integrity information** - Publish a SHA-256 or stronger checksum for the exact package artifact. - Verify the checksum before installation or execution. - Prefer signed releases with documented signature-verification instructions. 2. **Avoid global installation** - Replace `npm install -g` with a project-local, lockfile-backed installation. - Commit an appropriate lockfile so that transitive dependency versions and integrity hashes are fixed. 3. **Review the executable dependency** - Include the CLI source or a link to an immutable, auditable source revision. - Audit the package, its lifecycle scripts, and its transitive dependencies before recommending execution. 4. **Restrict lifecycle scripts where possible** - Use npm's `--ignore-scripts` option if the package operates correctly without installation scripts. - If lifecycle scripts are required, document and review every script before installation. 5. **Use execution isolation** - Run the CLI in a container or sandbox with a minimal filesystem view, restricted network access, and no unnecessary credentials. - Supply API credentials only for the duration of the required command. - Do not expose unrelated environment variables or host directories. 6. **Harden credential handling** - Apply restrictive permissions to `~/.dlazy/config.json`. - Prefer short-lived or narrowly scoped API credentials where supported. - Rotate credentials immediately if dependency compromise is suspected.