T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Unverified External npm CLI Is Installed and Executed with User Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7` and duplicated in `SKILL-cn.md:7` **Vulnerability Type**: Third-party supply-chain exposure through an externally retrieved executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当你需要使用此技能时，请严格遵循此技能提供的指南进行规划和执行。你可以通过调用 dlazy CLI 的各类生成模型（如 dlazy seedream-4.5 等）来完成实际的图片渲染。注意：Windows PowerShell 中不允许使用 `&` 或 `&&` 进行命令串联或后台运行，请单独且同步地执行命令。"}} ``` The dependency is also invoked through the following documented mechanism in `SKILL.md:45-51` and `SKILL-cn.md:45-51`: ```bash npx @dlazy/cli@1.2.3 <command> ``` The execution instructions at `SKILL.md:208` and `SKILL-cn.md:208` require the agent to run the CLI: ```text After user confirmation, you must use the terminal to execute a command (such as `dlazy seedream-4.5 --prompt "..."`), with only one generation command executed at a time. ``` ### Technical Analysis The Skill contains no local implementation of the `dlazy` executable. Instead, it directs the runtime to retrieve and execute `@dlazy/cli@1.2.3` from the npm ecosystem, either globally or through `npx`. Although the version is pinned, the audited project does not contain a vendored copy, lockfile, package digest, signature verification policy, or other mechanism that would allow the executable artifact to be matched to reviewed source code. A global npm installation can also execute package lifecycle scripts and place binaries into the user's global npm environment. The `npx` alternative avoids a persistent global binary but ...[truncated 2345 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the exact CLI source or distributable into a reviewable, trusted build process rather than downloading executable code during Skill use. 2. If npm distribution remains necessary, maintain a lockfile or approved-artifact manifest containing the exact package version and integrity digest. Verify the downloaded artifact before execution. 3. Establish provenance verification using signed releases, npm provenance attestations, and a documented mapping between the reviewed source commit and published package artifact. 4. Avoid global installation. Run the dependency in an isolated container or restricted subprocess with a dedicated working directory, minimal filesystem permissions, a constrained environment, and network access limited to required endpoints. 5. Disable unnecessary npm lifecycle scripts where compatible with the package, and review all required lifecycle behavior before enabling it. 6. Provide credentials only to the generation subprocess and only for the duration of the request. Restrict permissions on `~/.dlazy/config.json`, and support short-lived, narrowly scoped API tokens where possible. 7. Require explicit user consent before installing the dependency, transmitting prompts, or uploading local media. 8. Correct the documentation so every reference identifies version `1.2.3`, or update all installation commands and metadata to the actual reviewed release. Add an automated consistency check to prevent future version drift. 9. Document a dependency-update review procedure covering source changes, package contents, lifecycle scripts, transitive dependencies, and artifact integrity before changing the pinned version. ]]>