T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Third-Party npm Package Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 58-65`; mirrored in `SKILL-cn.md:5, 58-65` **Vulnerability Type**: Unverified third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🛒","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill product-to-ecommerce-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The skill instructs the environment to retrieve and execute `@dlazy/cli@1.2.3` from the npm registry. Although the package version is pinned, the project does not include the dependency source, an npm lockfile, a cryptographic integrity digest, a verified artifact signature, or other controls that bind execution to reviewed package contents. Version pinning limits unexpected upgrades but does not independently establish artifact integrity or trustworthiness. The `npx` path downloads and executes the package on demand, while the global installation path places the package persistently in the user's npm environment. npm lifecycle scripts may also execute during installation unless explicitly disabled. The audited project contains only documentation files, so the actual implementation and behavior of the referenced CLI could not be verified within the supplied audit scope. ### Attack Path 1. A user or Agent loads the skill and f ...[truncated 1449 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor and audit the required CLI implementation, or otherwise make the exact reviewed source available with the skill. 2. Supply a lockfile containing npm integrity hashes and verify the resolved package against the expected SHA-512 digest before execution. 3. Use signed release artifacts and verify the publisher identity and signature as part of installation. 4. Avoid global installation. Prefer an isolated, temporary environment with a minimal filesystem view and restricted permissions. 5. Disable npm lifecycle scripts where compatible, such as with `npm install --ignore-scripts`, and separately audit any scripts required for operation. 6. Pin and integrity-lock all transitive dependencies rather than relying only on a top-level semantic version. 7. Restrict the CLI's outbound network access to the explicitly documented service endpoints. 8. Run the CLI as an unprivileged account and never install it with administrator or root permissions. 9. Prevent unnecessary exposure of environment variables, credentials, and unrelated local files to the CLI process. 10. Establish dependency monitoring and repeat the security review before changing the package version or accepted integrity digest. ]]>