T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Execution of an Unverified Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4, 49-55`; `SKILL-cn.md:4, 48-54` **Vulnerability Type**: Third-party supply-chain exposure **Risk Level**: Medium ### Vulnerable Code `SKILL.md:4`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy gpt-image-2 -h for help."}} ``` `SKILL.md:49-55`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The equivalent installation declarations also appear in `SKILL-cn.md:4, 48-54`. ### Technical Analysis The Skill does not contain the implementation used to perform image generation. Instead, it directs the environment to download and execute `@dlazy/cli@1.2.3` through either `npx` or a global npm installation. The dependency is pinned to a specific version, which limits unintentional version drift. However, the Skill does not declare or verify an integrity hash, vendor the dependency, or provide the package source for review within the audited artifact. Consequently, the effective executable code is outside the scope of this audit. Both installation mechanisms execute code obtained from the npm supply chain: - `npx` can download and immediately execute the package. - `npm install -g` installs package files globally and may execute npm lifecycle scripts under the invoking user's ...[truncated 2355 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor and audit the exact CLI source used by the Skill, or include the minimal required implementation directly in the reviewed package. 2. Verify the downloaded package using an expected cryptographic integrity hash from a separately trusted source. 3. Maintain a lockfile or immutable dependency manifest covering all transitive dependencies, not only the top-level package version. 4. Publish reproducible build instructions so the npm artifact can be compared with the referenced source repository. 5. Disable npm lifecycle scripts where compatible, for example by using an installation process equivalent to `npm install --ignore-scripts`. 6. Prefer an isolated, non-privileged execution environment with: - Filesystem access limited to explicitly selected input and output files. - Network access restricted to documented dLazy endpoints. - No access to unrelated environment variables or user configuration. 7. Avoid global installation where possible, because it leaves executable package content available beyond the current task. 8. Require explicit user confirmation before uploading local files and clearly identify the destination service. 9. Store API credentials with restrictive permissions and use short-lived, scoped, and revocable credentials where supported. 10. Perform periodic review of the npm package, its maintainers, lifecycle scripts, release provenance, and transitive dependency tree. ]]>