T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:57-60`; mirrored in `SKILL-cn.md:5`, `SKILL-cn.md:57-60` **Vulnerability Type**: Third-party supply-chain exposure through npm installation and execution **Risk Level**: Medium ### Vulnerable Code ```json "install":"npm install -g @dlazy/cli@1.2.3", "installAlternative":"npx @dlazy/cli@1.2.3" ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text Or, if you prefer a global install, the skill's metadata.clawdbot.install field declares the exact pinned version (npm install -g @dlazy/cli@1.2.3). ``` ### Technical Analysis The skill delegates its implementation to the external npm package `@dlazy/cli@1.2.3`. The audited project contains only documentation and metadata; it does not include the CLI source, a package lockfile, a trusted integrity digest, signed provenance, or a vendored copy that would permit verification of the code ultimately executed. Pinning the dependency to version `1.2.3` reduces unexpected version drift, but it does not independently authenticate the registry artifact or protect against a compromised publisher account, registry compromise, malicious lifecycle scripts, or substitution in the package delivery chain. Both documented installation methods can execute third-party code: - `npm install -g` may run npm lifecycle scripts and installs the package globally for the current environment. - `npx` downloads or resolves the package and then executes its entry point. Package lifecycle scripts may also run during package installation. No evidence in the audited files establishes that the referenced package is malicious. The risk is that the effective executable payload is outside the reviewed project and is trusted without cryptographic verification beyond ordinary npm resolution. ### Attack Path 1. An attacker compromises the npm publisher account, package distribution channel, or artifact associated with `@dlazy/cli@1.2.3`. 2. The attacker introduces malic ...[truncated 1628 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the required executable implementation into the reviewed project or provide a reproducible build from a reviewed source revision. 2. Verify the npm artifact using a trusted integrity digest and fail closed if the downloaded artifact does not match. 3. Publish and verify signed package provenance, such as npm provenance backed by a protected release workflow. 4. Include a lockfile or equivalent manifest that records the complete dependency graph and integrity values. 5. Avoid global installation where possible. Prefer an isolated, project-local installation executed with a dedicated low-privilege account. 6. Disable npm lifecycle scripts during installation when the package does not require them, for example by using an appropriately tested `--ignore-scripts` workflow. 7. Run the CLI in a sandbox or container with: - Access only to explicitly selected input and output paths. - No access to unrelated credentials or home-directory files. - Network access restricted to the documented service endpoints. - No administrator or root privileges. 8. Review the exact source revision corresponding to version `1.2.3`, including lifecycle scripts and transitive dependencies, before allowing execution. 9. Add automated dependency scanning, provenance validation, and periodic review of the package ownership and release process. 10. Document the trust boundary explicitly so users understand that prompts, selected media, and credentials are processed by software outside the audited project. ]]>