T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Unverified Third-Party npm Package Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 51-57` **Mirrored Location**: `SKILL-cn.md:5, 51-57` **Vulnerability Type**: Unverified third-party dependency execution **Risk Level**: Medium ### Complete Code Snippet ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy jimeng-i2v-first-tail -h for help."}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill does not include the implementation of the CLI it instructs the Agent to execute. Instead, it retrieves `@dlazy/cli@1.2.3` from the npm registry through either `npx` or a global npm installation. Pinning the version reduces normal dependency drift, but it does not verify the downloaded package against a trusted cryptographic digest. The audited project therefore cannot establish that the registry artifact is identical to reviewed source code. If the package, publisher account, registry artifact, or dependency chain is compromised, npm installation hooks or the invoked CLI may execute attacker-controlled code. The global installation option increases exposure by persisting an executable outside the Skill directory. The documentation recommends source review, but it does not technically enforce artifact verification, lifecycle-script restrictions, sandboxing, or least-privilege execution. ### Attack Path 1. An attacker compromises the npm publisher account, package artifact, registry delivery path, or a transitive dependency used by `@dlazy/cli@1.2.3`. 2. A malicious art ...[truncated 1498 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the reviewed CLI implementation in the audited artifact, or otherwise ensure that the exact executable implementation is available for security review. 2. Verify the downloaded npm archive against a trusted, separately distributed cryptographic digest or signed provenance record before execution. 3. Prefer an immutable package source and enforce package-lock or equivalent integrity metadata. 4. Avoid global installation. Use an isolated, temporary execution environment with no persistent global binary placement. 5. Disable npm lifecycle scripts with `--ignore-scripts` where the package remains functional without them. 6. Execute the CLI in a sandbox or container with: - Access only to explicitly selected input and output files. - No access to unrelated home-directory content. - Restricted outbound network access limited to documented endpoints. - No administrative or root privileges. 7. Use a short-lived, task-scoped API credential rather than a broadly reusable credential, and rotate it if dependency compromise is suspected. 8. Audit the exact npm artifact and its full transitive dependency tree, rather than relying only on the linked GitHub repository. 9. Document and enforce a trusted installation procedure that fails closed when artifact integrity or provenance cannot be verified. ]]>