T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Third-Party CLI Is Downloaded and Executed Without Local Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 69-72`; mirrored configuration in `SKILL-cn.md:5, 69-72` **Vulnerability Type**: Third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, use dlazy <subcommand>."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` ### Technical Analysis The Skill delegates its operational behavior to the external npm package `@dlazy/cli@1.2.3`. The package is not included in the audited project, and the project does not provide a lockfile, vendored source, package archive, or independently verified integrity digest. Version pinning reduces unintentional version drift, but it does not independently establish the integrity or safety of the package retrieved from the npm registry. Both documented installation mechanisms execute externally supplied code: - `npx @dlazy/cli@1.2.3` can download and execute the package on demand. - `npm install -g @dlazy/cli@1.2.3` installs the executable globally for the current environment. - npm lifecycle scripts, if present in the external package or its transitive dependencies, may run during installation. - The CLI subsequently receives access to the configured dLazy API key, user-supplied local media files, and network endpoints. The project documentati ...[truncated 2023 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Vendor and audit the dependency** - Include the required CLI implementation or a reviewed package archive in a controlled release process. - Audit the exact source revision and all transitive dependencies before distribution. 2. **Verify artifact integrity** - Record and enforce the npm artifact's cryptographic integrity value. - Bind the reviewed source commit to the distributed npm package using reproducible builds, signed provenance, and package attestations. - Verify signatures or attestations before installation and execution. 3. **Avoid global installation** - Prefer an isolated, ephemeral execution environment over `npm install -g`. - Prevent the package from modifying persistent user-level command paths unless explicitly approved by the user. 4. **Restrict installation behavior** - Disable npm lifecycle scripts where compatible, such as by using `--ignore-scripts`. - Use a private allowlisted registry or verified package mirror. - Apply dependency lockfiles and automated vulnerability scanning to the complete dependency graph. 5. **Sandbox runtime access** - Run the CLI with access only to explicitly selected input files. - Restrict outbound network traffic to documented and approved endpoints. - Prevent access to unrelated home-directory files, credentials, SSH material, browser profiles, and other secrets. 6. **Protect credentials** - Store API credentials through an operating-system credential manager where possible. - Use narrowly scoped, revocable credentials and avoid exposing them to installation scripts. - Document credential rotation procedures for suspected package compromise. 7. **Make external execution explicit** - Require user confirmation before downloading, globally installing, or executing the third-party package. - Clearly identify the external code boundary and disclose that the dependency itself is outside the Skill package's audit scope ...[truncated 5 chars]