T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:5
- Finding
- Execution of an External npm Package Without Locally Auditable Implementation or Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:5, 52-58`; equivalent instructions in `SKILL-cn.md:5, 53-59` **Vulnerability Type**: Third-party supply-chain dependency **Risk Level**: Medium ### Complete Code Snippet From `SKILL.md`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy jimeng-t2i -h for help."}} ``` ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` The equivalent dependency installation and execution instructions occur in `SKILL-cn.md`. ### Technical Analysis The Skill delegates its security-sensitive behavior to the externally distributed npm package `@dlazy/cli@1.2.3`. That package is not included in the audited artifact, so its installation lifecycle, authentication handling, local-file access, upload behavior, and network requests cannot be verified from this project. Pinning the dependency to version `1.2.3` reduces unintentional version drift, but it does not cryptographically bind the Skill to a reviewed package artifact. The instructions provide neither a registry integrity digest nor a verified binary checksum. The global installation option also places executable code in the user's environment beyond the immediate invocation. This is a supply-chain trust-boundary issue rather than evidence that the n ...[truncated 1723 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the required implementation with the Skill so the exact executed code can be reviewed together with the Skill. 2. If external distribution remains necessary, publish and verify a cryptographic digest for the exact npm artifact before execution. 3. Commit an appropriate lockfile with registry integrity metadata where the execution environment supports it. 4. Prefer a reviewed, locally installed dependency over automatic `npx` retrieval during Skill invocation. 5. Avoid global installation by default; install into an isolated, least-privileged project directory or sandbox. 6. Disable npm lifecycle scripts where compatible, for example through an audited installation workflow using `--ignore-scripts`. 7. Run the CLI without administrative privileges and restrict its filesystem and network access to the minimum required directories and documented endpoints. 8. Document the precise files, credentials, and endpoints the CLI can access, and require user confirmation before uploading local files. 9. Independently audit the source and built npm artifact for version `1.2.3`, including lifecycle scripts and transitive dependencies, before approving deployment. 10. Provide credential rotation guidance in case dependency compromise is suspected.