T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unverified Third-Party CLI Executes Outside the Audited Project Boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4, 49-56`; mirrored in `SKILL-cn.md:4, 49-56` **Vulnerability Type**: Third-party supply-chain exposure through npm and npx execution **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:4`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy imageseg -h for help."}} ``` From `SKILL.md:49-56`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The equivalent installation instructions appear in `SKILL-cn.md:4, 49-56`. ### Technical Analysis The Skill delegates its functional behavior to the external npm package `@dlazy/cli@1.2.3`. Both the global installation command and the `npx` alternative retrieve and execute code that is not included in the audited project. Pinning the package version reduces version drift but does not independently establish the integrity of the downloaded artifact or its transitive dependencies. The audited project contains no vendored CLI source, dependency lockfile, package digest, signature, or verifiable build provenance. Therefore, the effective code that performs authentication, local file access, media upload, result download, and API communication cannot be validated from the two Skill documents. This finding does not establish that ...[truncated 1996 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the exact reviewed CLI source and dependency lockfile in the auditable artifact, or link the package version to an immutable source revision. 2. Publish and verify a cryptographic digest for the expected npm package artifact before execution. 3. Use npm provenance or trusted package signatures and document the verification procedure. 4. Audit all transitive dependencies and package lifecycle scripts associated with `@dlazy/cli@1.2.3`. 5. Prefer execution in an isolated, least-privilege environment with access restricted to only the input files required for image segmentation. 6. Prefer temporary, non-global installation over `npm install -g` to reduce persistent system changes. 7. Disable npm lifecycle scripts where compatible with the package and explicitly required functionality. 8. Restrict outbound network access to the documented endpoints after verifying that they are sufficient for operation. 9. Store the API key using an operating-system credential manager where possible, and ensure that configuration files remain accessible only to the owning user. 10. Require explicit user confirmation before uploading local files to the hosted service. ]]>