T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party npm Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 53-59, 73-74`; mirrored in `SKILL-cn.md:5, 53-59, 73-74` **Vulnerability Type**: Third-party software supply-chain exposure **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy gpt-image-2-5-sunburst -h for help."}} ``` `SKILL.md:53-59`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` `SKILL.md:73-74`: ```markdown **CRITICAL INSTRUCTION FOR AGENT**: Execute `dlazy gpt-image-2-5-sunburst` to get the result. ``` Equivalent installation and execution instructions appear in `SKILL-cn.md` at the same line ranges. ### Technical Analysis The Skill contains no executable implementation of its own. Instead, it depends on the externally distributed `@dlazy/cli` npm package and directs the Agent to install or execute it. Pinning the package to version `1.2.3` limits unintended version changes, but it does not independently verify the downloaded artifact's cryptographic integrity or establish that the npm artifact matches the linked source repository. The audited project also does not include a lockfile, checksum, signature, vendored source, or reviewed executable implementation for this dependency. The global instal ...[truncated 2257 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Vendor and audit the executable implementation** - Include the required CLI source or a minimal reviewed client in the Skill package. - Review all direct and transitive dependencies before release. - Re-audit the vendored implementation whenever it changes. 2. **Add artifact integrity verification** - Publish a cryptographic digest or signed provenance statement for the exact supported package artifact. - Verify the downloaded artifact before execution. - Ensure the verified npm artifact corresponds to the reviewed source revision. 3. **Use reproducible dependency controls** - Maintain a lockfile with exact transitive dependency versions and integrity values. - Use a controlled package registry or an internally mirrored, approved artifact. - Enable npm provenance and signature verification where supported. 4. **Avoid global installation** - Remove `npm install -g` from automatic installation metadata. - Prefer an isolated, ephemeral execution environment with a dedicated cache and no modification of system-level executable paths. 5. **Reduce installation-time execution** - Disable npm lifecycle scripts where compatible, such as by using `--ignore-scripts`. - Explicitly review any lifecycle scripts required by the package before permitting them. 6. **Apply runtime isolation** - Execute the CLI as a non-privileged dedicated user or within a sandbox/container. - Restrict filesystem access to explicitly selected input and output paths. - Restrict outbound network access to the documented endpoints only. - Avoid exposing unrelated environment variables or credentials to the process. 7. **Protect API credentials** - Store the API key using an OS credential manager where possible. - Enforce restrictive permissions on `~/.dlazy/config.json`. - Use narrowly scoped, revocable credentials and rotate them after suspected dependency compromise. ]]>