T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an Unverified Third-Party npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 65-71`; mirrored configuration in `SKILL-cn.md:5, 65-71` **Vulnerability Type**: Third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, use dlazy <subcommand>."}} ``` From `SKILL.md:65-71`: ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` The equivalent package installation and invocation instructions also appear in `SKILL-cn.md:5, 65-71`. ### Technical Analysis The Skill delegates its entire runtime behavior to the external npm package `@dlazy/cli@1.2.3`. Although an exact package version is specified, the audited project does not contain the package source, a package lockfile, a verified cryptographic digest, a signed provenance record, or a vendored and reviewed executable artifact. Version pinning limits accidental version drift, but it does not independently verify that the artifact downloaded from the registry is trustworthy. If the npm package, its transitive dependencies, its maintainer account, or the distribution channel is compromised, installation or `npx` execution may run attacker-controlled JavaScript. npm lifecycle hooks may also execute during package installation. The global installation form increases exposure by persistently placing the package in the user's global npm environment. The `npx` alternative avoids a permanent global binary but still retrieves and executes external package ...[truncated 1902 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the exact CLI source or distributable artifact into a controlled build process and audit it together with the Skill. 2. Verify downloaded packages using cryptographic integrity values, trusted signatures, and npm provenance attestations where available. 3. Maintain and review a lockfile covering the complete transitive dependency graph. 4. Generate a software bill of materials and continuously scan direct and transitive dependencies for known vulnerabilities and unexpected ownership changes. 5. Prefer an isolated, non-global installation over `npm install -g` to reduce persistence and prevent modification of the user's global tool environment. 6. Disable npm lifecycle scripts when they are not required, for example through an appropriately tested `--ignore-scripts` installation policy. 7. Execute the CLI in a sandbox or container with: - Access only to explicitly selected input files. - A read-only filesystem wherever possible. - No access to unrelated home-directory content. - Network access restricted to documented and verified endpoints. - No administrative or root privileges. 8. Store the API key in an operating-system credential manager rather than a regular configuration file where supported. 9. Use a narrowly scoped, revocable API key and rotate it after suspected package or workstation compromise. 10. Review the referenced upstream source and ensure that the reviewed commit corresponds cryptographically to the distributed npm artifact. ]]>