T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:4
- Finding
- Unverified Third-Party CLI Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4, 56-62`; equivalent instructions in `SKILL-cn.md:4, 55-61` **Vulnerability Type**: Third-party supply-chain exposure through npm installation and execution **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:4`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy jimeng-i2v-first -h for help."}} ``` From `SKILL.md:56-62`: ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` Equivalent code from `SKILL-cn.md:4`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当调用此技能时，可以使用 dlazy jimeng-i2v-first -h 查看帮助信息。"}} ``` From `SKILL-cn.md:55-61`: ```markdown 如果你不希望在系统上长期保留一个全局 CLI，可以按需运行： ```bash npx @dlazy/cli@1.2.3 <command> ``` 如选择全局安装，技能的 `metadata.clawdbot.install` 字段已固定到 `npm install -g @dlazy/cli@1.2.3`。安装前建议先到 GitHub 仓库审阅源码。 ``` ### Technical Analysis The project ...[truncated 2422 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed CLI implementation with the Skill, or otherwise make the exact executable source available as part of the auditable artifact. 2. Publish cryptographic checksums or signed release attestations for the npm package and verify them before execution. 3. Use npm provenance and signature verification where supported, and document the expected publisher and registry. 4. Pin and audit all transitive dependencies through a lockfile rather than relying only on the top-level package version. 5. Prefer a temporary, isolated installation over a global installation. Execute the CLI in a sandbox or container with only the required files and network destinations available. 6. Disable npm lifecycle scripts during installation where compatible, for example through an installation workflow using `--ignore-scripts`; explicitly run only reviewed setup steps if any are required. 7. Run the CLI as an unprivileged user and avoid installation with administrative or root permissions. 8. Provide only the specific input media required for a generation request, and avoid exposing unrelated directories to the process. 9. Store the API key with restrictive permissions, use a narrowly scoped credential where supported, and rotate it if dependency compromise is suspected. 10. Add automated dependency scanning, release-integrity validation, and periodic review of the referenced package and its dependency tree. ]]>