T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Externally Retrieved Third-Party CLI Without Locally Verifiable Integrity<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 56-62`; equivalent instructions also appear in `SKILL-cn.md:5, 56-62` **Vulnerability Type**: Third-party package supply-chain exposure **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy gpt-image-2-5-flare -h for help."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text npm install -g @dlazy/cli@1.2.3 ``` The Chinese-language document, `SKILL-cn.md`, declares and recommends the same package installation and execution mechanisms. ### Technical Analysis The Skill contains no executable implementation that can be audited locally. Instead, it delegates its complete runtime behavior to `@dlazy/cli@1.2.3`, retrieved from an external npm registry through either `npm install -g` or `npx`. Pinning the direct package to version `1.2.3` reduces accidental version drift, but it does not provide cryptographic verification within this project. The repository contains no package integrity hash, lockfile, vendored source, verified artifact, or pinned transitive dependency graph. npm installation may also execute package lifecycle scripts. Consequently, the effective code executed by the Skill is outside the reviewed artifact. This is a supply-chain risk rather than evidence that the named package is currently malicious. Exploitation would require compromise or substitution of the package artifact, a maintainer or registry account, the registry delivery path, or one of the package's unresolved tra ...[truncated 1627 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the required CLI implementation or provide an auditable local wrapper so the effective runtime code is included in the reviewed artifact. 2. Publish and verify a cryptographic integrity digest for the exact npm package artifact before execution. 3. Include a lockfile that pins the complete transitive dependency graph and verifies package integrity fields. 4. Disable npm lifecycle scripts where compatible, for example by using `--ignore-scripts`, and explicitly document any scripts that are genuinely required. 5. Prefer an isolated, non-global installation over `npm install -g` to limit persistence and system-wide exposure. 6. Run the CLI in a sandbox or container with: - Read access limited to explicitly selected input files. - Write access limited to a dedicated output directory. - No access to unrelated credentials or home-directory files. - Network access restricted to documented and required endpoints. 7. Store API credentials using an operating-system credential manager where possible, rather than a plaintext configuration file. 8. Independently review the source corresponding to version `1.2.3` and verify that the published npm artifact reproducibly matches that source. 9. Add automated dependency scanning, provenance verification, and package-signature checks to the release process. ]]>