T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:7
- Finding
- Execution of an Externally Retrieved and Unverified npm CLI## Vulnerability Details **File Location**: `SKILL.md:7-48` and mirrored content in `SKILL-cn.md:7-48` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Code Snippet**: ```yaml metadata: clawdbot: requires: bins: - npm - npx install: npm install -g @dlazy/cli@1.2.3 installAlternative: npx @dlazy/cli@1.2.3 homepage: https://github.com/dlazy-ai/cli source: https://github.com/dlazy-ai/cli npm: https://www.npmjs.com/package/@dlazy/cli configLocation: ~/.dlazy/config.json apiEndpoints: - api.dlazy.com - files.dlazy.com ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ### Technical Analysis The Skill directs the host to retrieve and execute `@dlazy/cli@1.2.3` from npm. Neither the CLI implementation nor its dependency tree is included in the audited project, so its handling of credentials, local files, lifecycle scripts, and network requests cannot be verified from the reviewed files. Pinning the package to a specific version reduces exposure to unintended future upgrades, but it does not verify package integrity or package provenance. The project provides no lockfile, cryptographic checksum, signature verification, vendored source, or sandbox policy. The global installation option also places an executable in the user's environment beyond the duration of an individual generation request. The Skill documents that the CLI receives a dLazy API key, transmits prompts to `api.dlazy.com`, and uploads selected media to `files.dlazy.com`. These operations are related to the declared functionality and are disclosed, but they increase the consequences of a supply-chain compromise because the downloaded package executes with the invoking user's permissions and can access the credentials and files exposed to it. No evidence establishes that the identified package is currently malicious. The vulnerability is the trust ...[truncated 1634 chars]
- Remediation
- ## Remediation Suggestions 1. Vendor the exact CLI source and audited dependency graph with the Skill, or otherwise make the reviewed implementation available as part of the artifact. 2. Publish verifiable package provenance and signatures, and enforce integrity verification before execution. 3. Include a lockfile that fixes all transitive dependencies rather than pinning only the top-level package. 4. Avoid global installation. Prefer an isolated, temporary execution environment with a minimal filesystem view. 5. Disable npm lifecycle scripts where operationally possible and explicitly audit any lifecycle scripts that are required. 6. Restrict outbound network access to documented endpoints and prevent access to unrelated local files. 7. Provide the API key through a short-lived secret mechanism rather than a broadly accessible process environment. 8. Use narrowly scoped, revocable API credentials and document credential rotation procedures. 9. Require explicit user selection and confirmation before uploading each local file, and warn users not to submit secrets or unnecessary personal data. 10. Perform an independent audit of `@dlazy/cli@1.2.3` and its complete transitive dependency tree before treating the Skill as trusted.