T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unverified Third-Party npm Package Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md:4`, `SKILL.md:62-68`, `SKILL-cn.md:4`, and `SKILL-cn.md:62-68` **Vulnerability Type**: Third-party supply-chain exposure through npm package execution **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:4`: ```text metadata: {"clawdbot":{"emoji":"📄","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill file-to-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}} ``` From `SKILL.md:62-68`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The corresponding installation instructions are duplicated in `SKILL-cn.md:4` and `SKILL-cn.md:62-68`. ### Technical Analysis The Skill directs the user or agent to retrieve and execute `@dlazy/cli@1.2.3` from the npm ecosystem. Pinning an exact version reduces unintended version drift, and the declared npm scope, repository, maintainer, and service branding are internally consistent. There is no evidence in the audited files of typo-squatting, dependency confusion, or deliberately malicious package selection. Nevertheless, the project does not contain the CLI source, a dependency lockfile, a trusted inte ...[truncated 2241 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the reviewed CLI source or distribute a signed, reproducible binary so the executed implementation corresponds to the audited artifact. 2. Publish trusted cryptographic hashes or signatures and verify them before installation or execution. 3. Maintain and audit a lockfile or software bill of materials covering all transitive dependencies. 4. Run the CLI in an isolated, least-privileged environment with access limited to files explicitly selected by the user. 5. Disable unnecessary npm lifecycle scripts where compatible with the package, such as by using `--ignore-scripts` after confirming that installation does not require them. 6. Prefer ephemeral execution in a sandbox over global installation. If global installation is necessary, document removal and update procedures. 7. Avoid running installation commands with administrator or root privileges. 8. Restrict credential-file permissions and use a narrowly scoped, revocable API key. 9. Independently review the exact package artifact and its transitive dependency graph before deployment rather than relying solely on the linked repository.